Fix a null ptr deref crash in DesktopCaptureDevice

content/browser/media/capture/desktop_capture_device.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/media/capture/desktop_capture_device.h"
 
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
@@ skipping 433 matching lines @@
   return result.Pass();
 }
 
 DesktopCaptureDevice::~DesktopCaptureDevice() {
   DCHECK(!core_);
 }
 
 void DesktopCaptureDevice::AllocateAndStart(
     const media::VideoCaptureParams& params,
     scoped_ptr<Client> client) {
-  thread_.message_loop_proxy()->PostTask(
+  thread_.task_runner()->PostTask(
       FROM_HERE,
       base::Bind(&Core::AllocateAndStart, base::Unretained(core_.get()), params,
                  base::Passed(&client)));
 }
 
 void DesktopCaptureDevice::StopAndDeAllocate() {
   if (core_) {
-    thread_.message_loop_proxy()->DeleteSoon(FROM_HERE, core_.release());
+    thread_.task_runner()->DeleteSoon(FROM_HERE, core_.release());
     thread_.Stop();
   }
 }
 
 void DesktopCaptureDevice::SetNotificationWindowId(
     gfx::NativeViewId window_id) {
-  thread_.message_loop_proxy()->PostTask(
-      FROM_HERE,
-      base::Bind(&Core::SetNotificationWindowId, base::Unretained(core_.get()),
-                 window_id));
+  // This may be called after the capturer has been stopped.
+  if (core_) {

[Sergey Ulanov, 2015/02/03 18:15:16]

nit: This can be more readable with "if (!core_)\n return;"

+    thread_.task_runner()->PostTask(
+        FROM_HERE,
+        base::Bind(&Core::SetNotificationWindowId,
+                   base::Unretained(core_.get()),
+                   window_id));
+  }
 }
 
 DesktopCaptureDevice::DesktopCaptureDevice(
     scoped_ptr<webrtc::DesktopCapturer> capturer,
     DesktopMediaID::Type type)
     : thread_("desktopCaptureThread") {
 #if defined(OS_WIN)
   // On Windows the thread must be a UI thread.
   base::MessageLoop::Type thread_type = base::MessageLoop::TYPE_UI;
 #else
   base::MessageLoop::Type thread_type = base::MessageLoop::TYPE_DEFAULT;
 #endif
 
   thread_.StartWithOptions(base::Thread::Options(thread_type, 0));
 
-  core_.reset(new Core(thread_.message_loop_proxy(), capturer.Pass(), type));
+  core_.reset(new Core(thread_.task_runner(), capturer.Pass(), type));
 }
 
 }  // namespace content