Use weak_ptr in bind call to TraceLog::OnFlushTimeout

base/debug/trace_event_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/debug/trace_event_impl.h"
 
 #include <algorithm>
 
 #include "base/base_switches.h"
 #include "base/bind.h"
@@ skipping 1194 matching lines @@
       process_sort_index_(0),
       process_id_hash_(0),
       process_id_(0),
       watch_category_(0),
       trace_options_(kInternalRecordUntilFull),
       sampling_thread_handle_(0),
       category_filter_(CategoryFilter::kDefaultCategoryFilterString),
       event_callback_category_filter_(
           CategoryFilter::kDefaultCategoryFilterString),
       thread_shared_chunk_index_(0),
-      generation_(0) {
+      generation_(0),
+      weak_ptr_factory_(this) {
   // Trace is enabled or disabled on one thread while other threads are
   // accessing the enabled flag. We don't care whether edge-case events are
   // traced or not, so we allow races on the enabled flag to keep the trace
   // macros fast.
   // TODO(jbates): ANNOTATE_BENIGN_RACE_SIZED crashes windows TSAN bots:
   // ANNOTATE_BENIGN_RACE_SIZED(g_category_group_enabled,
   //                            sizeof(g_category_group_enabled),
   //                           "trace_event category enabled");
   for (int i = 0; i < MAX_CATEGORY_GROUPS; ++i) {
     ANNOTATE_BENIGN_RACE(&g_category_group_enabled[i],
@@ skipping 494 matching lines @@
       }
     }
   }
 
   if (thread_message_loop_task_runners.size()) {
     for (size_t i = 0; i < thread_message_loop_task_runners.size(); ++i) {
       thread_message_loop_task_runners[i]->PostTask(
           FROM_HERE,
           Bind(&TraceLog::FlushCurrentThread, Unretained(this), generation));
     }
     flush_message_loop_proxy_->PostDelayedTask(

[mmenke, 2014/09/12 17:47:46]

The weak pointer factory can only vend weak points on the thread the TraceLog
lives on, and its weak pointers can only be dereferenced on the same thread.

As a result, this only works if the TraceLog is created and destroyed on the
flush_message_loop_proxy_'s message loop.

The real issue is that the message loop outlives the TraceLog, which breaks the
underlying assumptions of this code.

         FROM_HERE,
-        Bind(&TraceLog::OnFlushTimeout, Unretained(this), generation),
+        Bind(&TraceLog::OnFlushTimeout,
+             weak_ptr_factory_.GetWeakPtr(),
+             generation),
         TimeDelta::FromMilliseconds(kThreadFlushTimeoutMs));
     return;
   }
 
   FinishFlush(generation);
 }
 
 void TraceLog::ConvertTraceEventsToTraceFormat(
     scoped_ptr<TraceBuffer> logged_events,
     const TraceLog::OutputCallback& flush_output_callback) {
@@ skipping 828 matching lines @@
 }
 
 ScopedTraceBinaryEfficient::~ScopedTraceBinaryEfficient() {
   if (*category_group_enabled_) {
     TRACE_EVENT_API_UPDATE_TRACE_EVENT_DURATION(category_group_enabled_,
                                                 name_, event_handle_);
   }
 }
 
 }  // namespace trace_event_internal