Fixes a crash in WebRTCIdentityServiceHost

It previously assumes that WebRTCIdentityStore always out lives WebRTCIdentityServiceHost, which is not true. It's now holding a refptr of WebRTCIdentityStore instead of a raw pointer.
In addition, the identity request callback may be called after WebRTCIdentityServiceHost is gone. So now a WeakPtr of WebRTCIdentityServiceHost is bound to the completion callback.

BUG=322195

Review URL: https://codereview.chromium.org/84943009

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@237151 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 8 insertions, 6 deletions

diff --git a/content/browser/renderer_host/media/webrtc_identity_service_host.cc b/content/browser/renderer_host/media/webrtc_identity_service_host.cc
index 22f499a..16f7b6e 100644
--- a/content/browser/renderer_host/media/webrtc_identity_service_host.cc
+++ b/content/browser/renderer_host/media/webrtc_identity_service_host.cc
@@ -15,9 +15,10 @@ namespace content {
 
 WebRTCIdentityServiceHost::WebRTCIdentityServiceHost(
     int renderer_process_id,
-    WebRTCIdentityStore* identity_store)
+    scoped_refptr<WebRTCIdentityStore> identity_store)
     : renderer_process_id_(renderer_process_id),
-      identity_store_(identity_store) {}
+      identity_store_(identity_store),
+      weak_factory_(this) {}
 
 WebRTCIdentityServiceHost::~WebRTCIdentityServiceHost() {
   if (!cancel_callback_.is_null())
@@ -60,7 +61,7 @@ void WebRTCIdentityServiceHost::OnRequestIdentity(
       identity_name,
       common_name,
       base::Bind(&WebRTCIdentityServiceHost::OnComplete,
-                 base::Unretained(this),
+                 weak_factory_.GetWeakPtr(),
                  sequence_number));
   if (cancel_callback_.is_null()) {
     SendErrorMessage(sequence_number, net::ERR_UNEXPECTED);
diff --git a/content/browser/renderer_host/media/webrtc_identity_service_host.h b/content/browser/renderer_host/media/webrtc_identity_service_host.h
index 3a5921c..079e307 100644
--- a/content/browser/renderer_host/media/webrtc_identity_service_host.h
+++ b/content/browser/renderer_host/media/webrtc_identity_service_host.h
@@ -26,8 +26,8 @@ class WebRTCIdentityStore;
 // ERR_INSUFFICIENT_RESOURCES will be sent back to the renderer.
 class CONTENT_EXPORT WebRTCIdentityServiceHost : public BrowserMessageFilter {
  public:
-  explicit WebRTCIdentityServiceHost(int renderer_process_id,
-                                     WebRTCIdentityStore* identity_store);
+  WebRTCIdentityServiceHost(int renderer_process_id,
+                            scoped_refptr<WebRTCIdentityStore> identity_store);
 
  protected:
   virtual ~WebRTCIdentityServiceHost();
@@ -60,7 +60,8 @@ class CONTENT_EXPORT WebRTCIdentityServiceHost : public BrowserMessageFilter {
 
   int renderer_process_id_;
   base::Closure cancel_callback_;
-  WebRTCIdentityStore* identity_store_;
+  scoped_refptr<WebRTCIdentityStore> identity_store_;
+  base::WeakPtrFactory<WebRTCIdentityServiceHost> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(WebRTCIdentityServiceHost);
 };