Fixes possible use after free in SessionService

chrome/browser/sessions/session_service.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/sessions/session_service.h"
 
 #include <algorithm>
 #include <set>
 #include <utility>
 #include <vector>
@@ skipping 216 matching lines @@
 
 // SessionService -------------------------------------------------------------
 
 SessionService::SessionService(Profile* profile)
     : BaseSessionService(SESSION_RESTORE, profile, base::FilePath()),
       has_open_trackable_browsers_(false),
       move_on_new_browser_(false),
       save_delay_in_millis_(base::TimeDelta::FromMilliseconds(2500)),
       save_delay_in_mins_(base::TimeDelta::FromMinutes(10)),
       save_delay_in_hrs_(base::TimeDelta::FromHours(8)),
-      force_browser_not_alive_with_no_windows_(false) {
+      force_browser_not_alive_with_no_windows_(false),
+      weak_factory_(this) {
   Init();
 }
 
 SessionService::SessionService(const base::FilePath& save_path)
     : BaseSessionService(SESSION_RESTORE, NULL, save_path),
       has_open_trackable_browsers_(false),
       move_on_new_browser_(false),
       save_delay_in_millis_(base::TimeDelta::FromMilliseconds(2500)),
       save_delay_in_mins_(base::TimeDelta::FromMinutes(10)),
       save_delay_in_hrs_(base::TimeDelta::FromHours(8)),
-      force_browser_not_alive_with_no_windows_(false)  {
+      force_browser_not_alive_with_no_windows_(false),
+      weak_factory_(this) {
   Init();
 }
 
 SessionService::~SessionService() {
   // The BrowserList should outlive the SessionService since it's static and
   // the SessionService is a KeyedService.
   BrowserList::RemoveObserver(this);
   Save();
 }
 
@@ skipping 305 matching lines @@
       kCommandSetTabUserAgentOverride, tab_id.id(), user_agent_override));
 }
 
 base::CancelableTaskTracker::TaskId SessionService::GetLastSession(
     const SessionCallback& callback,
     base::CancelableTaskTracker* tracker) {
   // OnGotSessionCommands maps the SessionCommands to browser state, then run
   // the callback.
   return ScheduleGetLastSessionCommands(
       base::Bind(&SessionService::OnGotSessionCommands,
-                 base::Unretained(this), callback),
+                 weak_factory_.GetWeakPtr(), callback),
       tracker);
 }
 
 void SessionService::Save() {
   bool had_commands = !pending_commands().empty();
   BaseSessionService::Save();
   if (had_commands) {
     RecordSessionUpdateHistogramData(chrome::NOTIFICATION_SESSION_SERVICE_SAVED,
                                      &last_updated_save_time_);
     content::NotificationService::current()->Notify(
@@ skipping 1262 matching lines @@
     return;
   }
 
   // Check for any open windows for the current profile that we aren't tracking.
   for (chrome::BrowserIterator it; !it.done(); it.Next()) {
     if ((*it)->profile() == profile())
       return;
   }
   DeleteSessionOnlyData(profile());
 }