Fix a crash where the ResourceMessageFilter is deleted

chrome/browser/renderer_host/safe_browsing_resource_handler.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/safe_browsing_resource_handler.h"
 
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
+#include "chrome/browser/renderer_host/resource_message_filter.h"
+#include "chrome/common/notification_service.h"
 
 // Maximum time to wait for a gethash response from the Safe Browsing servers.
 static const int kMaxGetHashMs = 1000;
 
 SafeBrowsingResourceHandler::SafeBrowsingResourceHandler(
     ResourceHandler* handler,
     int render_process_host_id,
     int render_view_id,
     const GURL& url,
     ResourceType::Type resource_type,
     SafeBrowsingService* safe_browsing,
-    ResourceDispatcherHost* resource_dispatcher_host)
+    ResourceDispatcherHost* resource_dispatcher_host,
+    ResourceDispatcherHost::Receiver* receiver)
     : next_handler_(handler),
       render_process_host_id_(render_process_host_id),
       render_view_id_(render_view_id),
       paused_request_id_(-1),
       in_safe_browsing_check_(false),
       displaying_blocking_page_(false),
       safe_browsing_(safe_browsing),
       queued_error_request_id_(-1),
       rdh_(resource_dispatcher_host),
-      resource_type_(resource_type) {
+      resource_type_(resource_type),
+      receiver_(receiver) {
   if (safe_browsing_->CheckUrl(url, this)) {
     safe_browsing_result_ = SafeBrowsingService::URL_SAFE;
     safe_browsing_->LogPauseDelay(base::TimeDelta());  // No delay.
   } else {
     AddRef();
     in_safe_browsing_check_ = true;
     // Can't pause now because it's too early, so we'll do it in OnWillRead.
   }
+
+  NotificationService::current()->AddObserver(
+      this,
+      NotificationType::RESOURCE_MESSAGE_FILTER_SHUTDOWN,
+      Source<ResourceMessageFilter>(
+          static_cast<ResourceMessageFilter*>(receiver_)));
 }
 
 SafeBrowsingResourceHandler::~SafeBrowsingResourceHandler() {
-  // If we're being deleted before the SafeBrowsing check has completed, cancel
-  // the check.
-  if (in_safe_browsing_check_)
-    safe_browsing_->CancelCheck(this);
+  NotificationService::current()->RemoveObserver(
+      this,
+      NotificationType::RESOURCE_MESSAGE_FILTER_SHUTDOWN,
+      Source<ResourceMessageFilter>(
+          static_cast<ResourceMessageFilter*>(receiver_)));
 }
 
 bool SafeBrowsingResourceHandler::OnUploadProgress(int request_id,
                                                    uint64 position,
                                                    uint64 size) {
   return next_handler_->OnUploadProgress(request_id, position, size);
 }
 
 bool SafeBrowsingResourceHandler::OnRequestRedirected(int request_id,
                                                       const GURL& new_url) {
@@ skipping 128 matching lines @@
           queued_security_info_);
       queued_error_.reset();
       queued_security_info_.clear();
     }
   } else {
     rdh_->CancelRequest(render_process_host_id_, paused_request_id_, false);
   }
 
   Release();
 }
+
+void SafeBrowsingResourceHandler::Observe(NotificationType type,
+                                          const NotificationSource& source,
+                                          const NotificationDetails& details) {
+  DCHECK(type.value == NotificationType::RESOURCE_MESSAGE_FILTER_SHUTDOWN);
+  if (in_safe_browsing_check_) {
+    safe_browsing_->CancelCheck(this);
+    in_safe_browsing_check_ = false;
+    Release();
+  }
+}
+