overscroll: Make sure async screenshot callbacks don't crash when the tab gets closed.

Taking a screenshot can be async. So use a weakptr for the callback to make
sure that the screenshot completion callback does not trigger on a destroyed
NavigationControllerImpl.

BUG=174444

Review URL: https://codereview.chromium.org/12217022

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@180903 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 8 insertions, 2 deletions

diff --git a/content/browser/web_contents/navigation_controller_impl.cc b/content/browser/web_contents/navigation_controller_impl.cc
index b8f9806..3fd2122 100644
--- a/content/browser/web_contents/navigation_controller_impl.cc
+++ b/content/browser/web_contents/navigation_controller_impl.cc
@@ -219,7 +219,8 @@ NavigationControllerImpl::NavigationControllerImpl(
       needs_reload_(false),
       is_initial_navigation_(true),
       pending_reload_(NO_RELOAD),
-      get_timestamp_callback_(base::Bind(&base::Time::Now)) {
+      get_timestamp_callback_(base::Bind(&base::Time::Now)),
+      ALLOW_THIS_IN_INITIALIZER_LIST(take_screenshot_factory_(this)) {
   DCHECK(browser_context_);
 }
 
@@ -503,7 +504,7 @@ void NavigationControllerImpl::TakeScreenshot() {
   render_view_host->CopyFromBackingStore(gfx::Rect(),
       view->GetViewBounds().size(),
       base::Bind(&NavigationControllerImpl::OnScreenshotTaken,
-                 base::Unretained(this),
+                 take_screenshot_factory_.GetWeakPtr(),
                  entry->GetUniqueID()));
 }
 
diff --git a/content/browser/web_contents/navigation_controller_impl.h b/content/browser/web_contents/navigation_controller_impl.h
index 849a80a..62101eb 100644
--- a/content/browser/web_contents/navigation_controller_impl.h
+++ b/content/browser/web_contents/navigation_controller_impl.h
@@ -411,6 +411,11 @@ class CONTENT_EXPORT NavigationControllerImpl
   // is used only for testing.
   base::Callback<void(RenderViewHost*)> take_screenshot_callback_;
 
+  // Taking a screenshot can be async. So use a weakptr for the callback to make
+  // sure that the screenshot completion callback does not trigger on a
+  // destroyed NavigationControllerImpl.
+  base::WeakPtrFactory<NavigationControllerImpl> take_screenshot_factory_;
+
   // Used to smooth out timestamps from |get_timestamp_callback_|.
   // Without this, whenever there is a run of redirects or
   // code-generated navigations, those navigations may occur within