Fix crash in NativeMessageProcessHost

chrome/browser/extensions/api/messaging/native_message_process_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/messaging/native_message_process_host.h"
 
 #include "base/bind.h"
 #include "base/files/file_path.h"
 #include "base/logging.h"
 #include "base/process/kill.h"
@@ skipping 24 matching lines @@
 const size_t kReadBufferSize = 4096;
 
 }  // namespace
 
 namespace extensions {
 
 NativeMessageProcessHost::NativeMessageProcessHost(
     const std::string& source_extension_id,
     const std::string& native_host_name,
     scoped_ptr<NativeProcessLauncher> launcher)
-    : source_extension_id_(source_extension_id),
+    : client_(NULL),
+      source_extension_id_(source_extension_id),
       native_host_name_(native_host_name),
       launcher_(launcher.Pass()),
       closed_(false),
       process_handle_(base::kNullProcessHandle),
 #if defined(OS_POSIX)
       read_file_(-1),
 #endif
       read_pending_(false),
       write_pending_(false) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
   task_runner_ = content::BrowserThread::GetMessageLoopProxyForThread(
       content::BrowserThread::IO);
-  // It's safe to use base::Unretained() here because NativeMessagePort always
-  // deletes us on the IO thread.
-  task_runner_->PostTask(
-      FROM_HERE,
-      base::Bind(&NativeMessageProcessHost::LaunchHostProcess,
-                 base::Unretained(this)));
 }
 
 NativeMessageProcessHost::~NativeMessageProcessHost() {
   DCHECK(task_runner_->BelongsToCurrentThread());
 }
 
 // static
 scoped_ptr<NativeMessageHost> NativeMessageHost::Create(
     gfx::NativeView native_view,
     const std::string& source_extension_id,
@@ skipping 92 matching lines @@
 
   // Send() may be called before the host process is started. In that case the
   // message will be written when OnHostProcessLaunched() is called. If it's
   // already started then write the message now.
   if (write_stream_)
     DoWrite();
 }
 
 void NativeMessageProcessHost::Start(Client* client) {
   DCHECK(task_runner_->BelongsToCurrentThread());
+  DCHECK(!client_);
   client_ = client;
+  // It's safe to use base::Unretained() here because NativeMessagePort always
+  // deletes us on the IO thread.
+  task_runner_->PostTask(
+      FROM_HERE,
+      base::Bind(&NativeMessageProcessHost::LaunchHostProcess,
+                 base::Unretained(this)));
 }
 
 scoped_refptr<base::SingleThreadTaskRunner>
 NativeMessageProcessHost::task_runner() const {
   return task_runner_;
 }
 
 #if defined(OS_POSIX)
 void NativeMessageProcessHost::OnFileCanReadWithoutBlocking(int fd) {
   DCHECK_EQ(fd, read_file_);
@@ skipping 166 matching lines @@
     content::BrowserThread::PostBlockingPoolTask(
         FROM_HERE, base::Bind(&base::EnsureProcessTerminated, process_handle_));
 #else
     base::EnsureProcessTerminated(process_handle_);
 #endif
     process_handle_ = base::kNullProcessHandle;
   }
 }
 
 }  // namespace extensions