Fix use-after-free in WebSocketHost::AddChannel()

content/browser/renderer_host/websocket_host.cc

Index: content/browser/renderer_host/websocket_host.cc
diff --git a/content/browser/renderer_host/websocket_host.cc b/content/browser/renderer_host/websocket_host.cc
index ddbb6e0982caa0b0dd482b74b0d4b14d137cd53f..f9ea7cc5132cb2907848f2d264c1ec97b547c895 100644
--- a/content/browser/renderer_host/websocket_host.cc
+++ b/content/browser/renderer_host/websocket_host.cc
@@ -367,6 +367,7 @@ void WebSocketHost::OnAddChannelRequest(
   } else {
     AddChannel(socket_url, requested_protocols, origin, render_frame_id);
   }
+  // |this| might be deleted here.

[Adam Rice, 2015/03/12 08:27:24]

Nit: "might be deleted" is slightly ambiguous; I would prefer the wording "may
have been deleted".

Also in AddChannel() below.

[hiroshige, 2015/03/12 08:50:19]

Done.

 }
 
 void WebSocketHost::AddChannel(
@@ -386,12 +387,23 @@ void WebSocketHost::AddChannel(
       new WebSocketEventHandler(dispatcher_, routing_id_, render_frame_id));
   channel_.reset(
       new net::WebSocketChannel(event_interface.Pass(), url_request_context_));
-  channel_->SendAddChannelRequest(socket_url, requested_protocols, origin);
 
   if (pending_flow_control_quota_ > 0) {
-    channel_->SendFlowControl(pending_flow_control_quota_);
+    // channel_->SendFlowControl(pending_flow_control_quota_) should be called

[Adam Rice, 2015/03/12 08:27:24]

s/should/must/

[hiroshige, 2015/03/12 08:50:19]

Done.

+    // after channel_->SendAddChannelRequest() below.
+    // We post OnFlowControl() here using |weak_ptr_factory_| instead of
+    // calling SendFlowControl directly, because |this| might be deleted
+    // after channel_->SendAddChannelRequest().
+    base::MessageLoop::current()->PostTask(
+        FROM_HERE,
+        base::Bind(&WebSocketHost::OnFlowControl,
+                   weak_ptr_factory_.GetWeakPtr(),
+                   pending_flow_control_quota_));
     pending_flow_control_quota_ = 0;
   }
+
+  channel_->SendAddChannelRequest(socket_url, requested_protocols, origin);
+  // |this| might be deleted here.
 }
 
 void WebSocketHost::OnSendFrame(bool fin,