Fix a null ptr deref crash in DesktopCaptureDevice

content/browser/media/capture/desktop_capture_device.cc

Index: content/browser/media/capture/desktop_capture_device.cc
diff --git a/content/browser/media/capture/desktop_capture_device.cc b/content/browser/media/capture/desktop_capture_device.cc
index 0ddcf2698cae148732a85b5eaa26fb190d661869..518e5ebb5364ac956a04fdc4e8be7fef9dd0bb57 100644
--- a/content/browser/media/capture/desktop_capture_device.cc
+++ b/content/browser/media/capture/desktop_capture_device.cc
@@ -451,7 +451,7 @@ DesktopCaptureDevice::~DesktopCaptureDevice() {
 void DesktopCaptureDevice::AllocateAndStart(
     const media::VideoCaptureParams& params,
     scoped_ptr<Client> client) {
-  thread_.message_loop_proxy()->PostTask(
+  thread_.task_runner()->PostTask(
       FROM_HERE,
       base::Bind(&Core::AllocateAndStart, base::Unretained(core_.get()), params,
                  base::Passed(&client)));
@@ -459,17 +459,21 @@ void DesktopCaptureDevice::AllocateAndStart(
 
 void DesktopCaptureDevice::StopAndDeAllocate() {
   if (core_) {
-    thread_.message_loop_proxy()->DeleteSoon(FROM_HERE, core_.release());
+    thread_.task_runner()->DeleteSoon(FROM_HERE, core_.release());
     thread_.Stop();
   }
 }
 
 void DesktopCaptureDevice::SetNotificationWindowId(
     gfx::NativeViewId window_id) {
-  thread_.message_loop_proxy()->PostTask(
-      FROM_HERE,
-      base::Bind(&Core::SetNotificationWindowId, base::Unretained(core_.get()),
-                 window_id));
+  // This may be called after the capturer has been stopped.
+  if (core_) {

[Sergey Ulanov, 2015/02/03 18:15:16]

nit: This can be more readable with "if (!core_)\n return;"

+    thread_.task_runner()->PostTask(
+        FROM_HERE,
+        base::Bind(&Core::SetNotificationWindowId,
+                   base::Unretained(core_.get()),
+                   window_id));
+  }
 }
 
 DesktopCaptureDevice::DesktopCaptureDevice(
@@ -485,7 +489,7 @@ DesktopCaptureDevice::DesktopCaptureDevice(
 
   thread_.StartWithOptions(base::Thread::Options(thread_type, 0));
 
-  core_.reset(new Core(thread_.message_loop_proxy(), capturer.Pass(), type));
+  core_.reset(new Core(thread_.task_runner(), capturer.Pass(), type));
 }
 
 }  // namespace content