Fix use-after-free in WebSocketHost::AddChannel()

content/browser/renderer_host/websocket_host.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/websocket_host.h"
 
 #include "base/basictypes.h"
 #include "base/memory/weak_ptr.h"
 #include "base/strings/string_util.h"
 #include "content/browser/renderer_host/websocket_dispatcher_host.h"
@@ skipping 349 matching lines @@
         base::Bind(&WebSocketHost::AddChannel,
                    weak_ptr_factory_.GetWeakPtr(),
                    socket_url,
                    requested_protocols,
                    origin,
                    render_frame_id),
         delay_);
   } else {
     AddChannel(socket_url, requested_protocols, origin, render_frame_id);
   }
+  // |this| may have been deleted here.
 }
 
 void WebSocketHost::AddChannel(
     const GURL& socket_url,
     const std::vector<std::string>& requested_protocols,
     const url::Origin& origin,
     int render_frame_id) {
   DVLOG(3) << "WebSocketHost::AddChannel"
            << " routing_id=" << routing_id_ << " socket_url=\"" << socket_url
            << "\" requested_protocols=\""
            << JoinString(requested_protocols, ", ") << "\" origin=\""
            << origin.string() << "\"";
 
   DCHECK(!channel_);
 
   scoped_ptr<net::WebSocketEventInterface> event_interface(
       new WebSocketEventHandler(dispatcher_, routing_id_, render_frame_id));
   channel_.reset(
       new net::WebSocketChannel(event_interface.Pass(), url_request_context_));
-  channel_->SendAddChannelRequest(socket_url, requested_protocols, origin);
 
   if (pending_flow_control_quota_ > 0) {
-    channel_->SendFlowControl(pending_flow_control_quota_);
+    // channel_->SendFlowControl(pending_flow_control_quota_) must be called
+    // after channel_->SendAddChannelRequest() below.
+    // We post OnFlowControl() here using |weak_ptr_factory_| instead of
+    // calling SendFlowControl directly, because |this| may have been deleted
+    // after channel_->SendAddChannelRequest().
+    base::MessageLoop::current()->PostTask(
+        FROM_HERE,
+        base::Bind(&WebSocketHost::OnFlowControl,
+                   weak_ptr_factory_.GetWeakPtr(),
+                   pending_flow_control_quota_));
     pending_flow_control_quota_ = 0;
   }
+
+  channel_->SendAddChannelRequest(socket_url, requested_protocols, origin);
+  // |this| may have been deleted here.
 }
 
 void WebSocketHost::OnSendFrame(bool fin,
                                 WebSocketMessageType type,
                                 const std::vector<char>& data) {
   DVLOG(3) << "WebSocketHost::OnSendFrame"
            << " routing_id=" << routing_id_ << " fin=" << fin
            << " type=" << type << " data is " << data.size() << " bytes";
 
   DCHECK(channel_);
@@ skipping 32 matching lines @@
                                    "");
     DCHECK_EQ(WebSocketDispatcherHost::WEBSOCKET_HOST_DELETED, result);
     return;
   }
 
   // TODO(yhirano): Handle |was_clean| appropriately.
   channel_->StartClosingHandshake(code, reason);
 }
 
 }  // namespace content