Fix a crash by checking if a given request id existed in our list before processing events for it.

The code was assuming that calls from webkit/renderer would always have the correct IDs, when in reality
due to the multiprocess nature of Chromium the renderer may send multiple requests to cancel/stop an
ongoing speech session before it received a response (if the user clicked fast enough).

I have not added a new test for this because the existing test is flaky and didn't seem right to add another flaky test like that. Instead I've added a TODO to add a browser test for this case once the flaky test has been fixed (since I'm also working on that now)

BUG=59173
TEST=none.

Review URL: http://codereview.chromium.org/3818003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@62744 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 17 insertions, 4 deletions

diff --git a/chrome/browser/speech/speech_input_browsertest.cc b/chrome/browser/speech/speech_input_browsertest.cc
index b142b7f..b8c0e7f 100644
--- a/chrome/browser/speech/speech_input_browsertest.cc
+++ b/chrome/browser/speech/speech_input_browsertest.cc
@@ -97,6 +97,12 @@ class SpeechInputBrowserTest : public InProcessBrowserTest {
   }
 };
 
+// Marked as FLAKY due to http://crbug.com/51337
+//
+// TODO(satish): Once this flakiness has been fixed, add a second test here to
+// check for sending many clicks in succession to the speech button and verify
+// that it doesn't cause any crash but works as expected. This should act as the
+// test for http://crbug.com/59173
 IN_PROC_BROWSER_TEST_F(SpeechInputBrowserTest, FLAKY_TestBasicRecognition) {
   // Inject the fake manager factory so that the test result is returned to the
   // web page.
diff --git a/chrome/browser/speech/speech_input_dispatcher_host.cc b/chrome/browser/speech/speech_input_dispatcher_host.cc
index 5c13e5c..bd35b13 100644
--- a/chrome/browser/speech/speech_input_dispatcher_host.cc
+++ b/chrome/browser/speech/speech_input_dispatcher_host.cc
@@ -64,7 +64,11 @@ int SpeechInputDispatcherHost::SpeechInputCallers::GetId(int render_process_id,
       return it->first;
     }
   }
-  NOTREACHED() << "Entry not found";
+
+  // Not finding an entry here is valid since a cancel/stop may have been issued
+  // by the renderer and before it received our response the user may have
+  // clicked the button to stop again. The caller of this method should take
+  // care of this case.
   return 0;
 }
 
@@ -148,15 +152,18 @@ void SpeechInputDispatcherHost::OnCancelRecognition(int render_view_id,
                                                     int request_id) {
   int caller_id = callers_->GetId(resource_message_filter_process_id_,
                                  render_view_id, request_id);
-  manager()->CancelRecognition(caller_id);
-  callers_->RemoveId(caller_id);  // Request sequence ended, so remove mapping.
+  if (caller_id) {
+    manager()->CancelRecognition(caller_id);
+    callers_->RemoveId(caller_id);  // Request sequence ended so remove mapping.
+  }
 }
 
 void SpeechInputDispatcherHost::OnStopRecording(int render_view_id,
                                                 int request_id) {
   int caller_id = callers_->GetId(resource_message_filter_process_id_,
                                   render_view_id, request_id);
-  manager()->StopRecording(caller_id);
+  if (caller_id)
+    manager()->StopRecording(caller_id);
 }
 
 void SpeechInputDispatcherHost::SendMessageToRenderView(IPC::Message* message,