Fix nullptr deref in ChildThreadImpl

content/child/child_thread_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/child_thread_impl.h"
 
 #include <signal.h>
 #include <string>
 #include <utility>
 
@@ skipping 485 matching lines @@
   channel_->AddFilter(notification_dispatcher_->GetFilter());
   channel_->AddFilter(service_worker_message_filter_->GetFilter());
 
   if (!IsInBrowserProcess()) {
     // In single process mode, browser-side tracing and memory will cover the
     // whole process including renderers.
     channel_->AddFilter(new tracing::ChildTraceMessageFilter(
         ChildProcess::current()->io_task_runner()));
     channel_->AddFilter(new ChildMemoryMessageFilter());
 
-    memory_instrumentation::MemoryDumpManagerDelegateImpl::Config config(
-        GetConnector(), mojom::kBrowserServiceName);
-    auto delegate =
-        base::MakeUnique<memory_instrumentation::MemoryDumpManagerDelegateImpl>(
-            config);
-    base::trace_event::MemoryDumpManager::GetInstance()->Initialize(
-        std::move(delegate));
+    if (GetConnector()) {

[Lei Zhang, 2017/03/25 01:56:34]

GetConnector() is service_manager_connection_->GetConnector() underneath. So
maybe |service_manager_connection_| is a nullptr? In which case, this won't be
affective.

You may be on the right track, because the code below on line 519 affected the
Cloud Print Connector as well.

[Ken Rockot(use gerrit already), 2017/03/25 02:02:48]

Thanks. Fixed. /shamecube

+      memory_instrumentation::MemoryDumpManagerDelegateImpl::Config config(
+          GetConnector(), mojom::kBrowserServiceName);
+      auto delegate = base::MakeUnique<
+          memory_instrumentation::MemoryDumpManagerDelegateImpl>(config);
+      base::trace_event::MemoryDumpManager::GetInstance()->Initialize(
+          std::move(delegate));
+    }
   }
 
   // In single process mode we may already have a power monitor,
   // also for some edge cases where there is no ServiceManagerConnection, we do
   // not create the power monitor.
   if (!base::PowerMonitor::Get() && service_manager_connection_) {
     std::unique_ptr<service_manager::Connection> device_connection =
         service_manager_connection_->GetConnector()->Connect(
             device::mojom::kServiceName);
     auto power_monitor_source =
@@ skipping 351 matching lines @@
   connected_to_browser_ = true;
   child_info_ = local_info;
   browser_info_ = remote_info;
 }
 
 bool ChildThreadImpl::IsInBrowserProcess() const {
   return static_cast<bool>(browser_process_io_runner_);
 }
 
 }  // namespace content