Fixes use after free in HWNDMessageHandler

ui/views/win/hwnd_message_handler.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef UI_VIEWS_WIN_HWND_MESSAGE_HANDLER_H_
 #define UI_VIEWS_WIN_HWND_MESSAGE_HANDLER_H_
 
 #include <windows.h>
 
 #include <set>
@@ skipping 60 matching lines @@
   /* "handled" management for cracked handlers */ \
   void SetMsgHandled(BOOL handled) { \
     msg_handled_ = handled; \
   } \
   BOOL ProcessWindowMessage(HWND hwnd, \
                             UINT msg, \
                             WPARAM w_param, \
                             LPARAM l_param, \
                             LRESULT& l_result, \
                             DWORD msg_map_id = 0) { \
+    base::WeakPtr<HWNDMessageHandler> ref(weak_factory_.GetWeakPtr()); \
     BOOL old_msg_handled = msg_handled_; \
     BOOL ret = _ProcessWindowMessage(hwnd, msg, w_param, l_param, l_result, \
                                      msg_map_id); \
-    msg_handled_ = old_msg_handled; \
+    if (ref.get()) \
+      msg_handled_ = old_msg_handled; \
     return ret; \
   } \
   BOOL _ProcessWindowMessage(HWND hWnd, \
                              UINT uMsg, \
                              WPARAM wParam, \
                              LPARAM lParam, \
                              LRESULT& lResult, \
                              DWORD dwMsgMapID) { \
     base::WeakPtr<HWNDMessageHandler> ref(weak_factory_.GetWeakPtr()); \
     BOOL bHandled = TRUE; \
@@ skipping 506 matching lines @@
   // Time the last WM_MOUSEHWHEEL message is received. Please refer to the
   // HandleMouseEventInternal function as to why this is needed.
   long last_mouse_hwheel_time_;
 
   DISALLOW_COPY_AND_ASSIGN(HWNDMessageHandler);
 };
 
 }  // namespace views
 
 #endif  // UI_VIEWS_WIN_HWND_MESSAGE_HANDLER_H_