Fix a crash in MediaSessionServiceImpl due to life time issue

content/browser/media/session/media_session_service_impl.cc

Index: content/browser/media/session/media_session_service_impl.cc
diff --git a/content/browser/media/session/media_session_service_impl.cc b/content/browser/media/session/media_session_service_impl.cc
index 1d93af395a1768bfd000c226d51b0d862230ebf8..7cc68d32700350c2a7cb6567d705071f9e845f7b 100644
--- a/content/browser/media/session/media_session_service_impl.cc
+++ b/content/browser/media/session/media_session_service_impl.cc
@@ -8,13 +8,15 @@
 #include "content/browser/media/session/media_session_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
 
 namespace content {
 
 MediaSessionServiceImpl::MediaSessionServiceImpl(
     RenderFrameHost* render_frame_host)
-    : render_frame_host_(render_frame_host),
+    : render_frame_process_id_(render_frame_host->GetProcess()->GetID()),
+      render_frame_routing_id_(render_frame_host->GetRoutingID()),
       playback_state_(blink::mojom::MediaSessionPlaybackState::NONE) {
   MediaSessionImpl* session = GetMediaSession();
   if (session)
@@ -36,6 +38,11 @@ void MediaSessionServiceImpl::Create(
   impl->Bind(std::move(request));
 }
 
+RenderFrameHost* MediaSessionServiceImpl::GetRenderFrameHost() {
+  return content::RenderFrameHost::FromID(render_frame_process_id_,
+                                          render_frame_routing_id_);
+}
+
 void MediaSessionServiceImpl::SetClient(
     blink::mojom::MediaSessionClientPtr client) {
   client_ = std::move(client);
@@ -55,8 +62,10 @@ void MediaSessionServiceImpl::SetMetadata(
   // coming from a known and secure source. It must be processed accordingly.
   if (metadata.has_value() &&
       !MediaMetadataSanitizer::CheckSanity(metadata.value())) {
-    render_frame_host_->GetProcess()->ShutdownForBadMessage(
-        RenderProcessHost::CrashReportMode::GENERATE_CRASH_DUMP);
+    if (GetRenderFrameHost()) {

[whywhat, 2017/02/23 17:57:42]

nit: maybe store GetRenderFrameHost() not to call it twice?

[Zhiqiang Zhang (Slow), 2017/02/23 20:15:55]

Done.

+      GetRenderFrameHost()->GetProcess()->ShutdownForBadMessage(
+          RenderProcessHost::CrashReportMode::GENERATE_CRASH_DUMP);
+    }
     return;
   }
   metadata_ = metadata;
@@ -83,8 +92,9 @@ void MediaSessionServiceImpl::DisableAction(
 }
 
 MediaSessionImpl* MediaSessionServiceImpl::GetMediaSession() {
-  WebContentsImpl* contents = static_cast<WebContentsImpl*>(
-      WebContentsImpl::FromRenderFrameHost(render_frame_host_));
+  RenderFrameHost* rfh = GetRenderFrameHost();
+  WebContentsImpl* contents =
+      static_cast<WebContentsImpl*>(WebContentsImpl::FromRenderFrameHost(rfh));

[whywhat, 2017/02/23 17:57:42]

nit: does it handle nullptr properly?

[Zhiqiang Zhang (Slow), 2017/02/23 20:15:55]

Yes. But let's be safe. Added a null-check.

   if (!contents)
     return nullptr;
   return MediaSessionImpl::Get(contents);