Fix a null ptr deref crash in DesktopCaptureDevice

content/browser/media/capture/desktop_capture_device.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/media/capture/desktop_capture_device.h"
 
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
@@ skipping 448 matching lines @@
 
 void DesktopCaptureDevice::StopAndDeAllocate() {
   if (core_) {
     thread_.message_loop_proxy()->DeleteSoon(FROM_HERE, core_.release());
     thread_.Stop();
   }
 }
 
 void DesktopCaptureDevice::SetNotificationWindowId(
     gfx::NativeViewId window_id) {
-  thread_.message_loop_proxy()->PostTask(
-      FROM_HERE,
-      base::Bind(&Core::SetNotificationWindowId, base::Unretained(core_.get()),
-                 window_id));
+  // This may be called after the capturer has been stopped.
+  if (thread_.message_loop_proxy()) {

[Sergey Ulanov, 2015/02/03 17:49:18]

I'd prefer checking that core_ is not nullptr here instead of
message_loop_proxy()

Also message_loop_proxy() is deprecated. task_runner() should be used instead.

[jiayl, 2015/02/03 17:54:09]

Done.

+    thread_.message_loop_proxy()->PostTask(
+        FROM_HERE,
+        base::Bind(&Core::SetNotificationWindowId,
+                   base::Unretained(core_.get()),
+                   window_id));
+  }
 }
 
 DesktopCaptureDevice::DesktopCaptureDevice(
     scoped_ptr<webrtc::DesktopCapturer> capturer,
     DesktopMediaID::Type type)
     : thread_("desktopCaptureThread") {
 #if defined(OS_WIN)
   // On Windows the thread must be a UI thread.
   base::MessageLoop::Type thread_type = base::MessageLoop::TYPE_UI;
 #else
   base::MessageLoop::Type thread_type = base::MessageLoop::TYPE_DEFAULT;
 #endif
 
   thread_.StartWithOptions(base::Thread::Options(thread_type, 0));
 
   core_.reset(new Core(thread_.message_loop_proxy(), capturer.Pass(), type));
 }
 
 }  // namespace content