Revert 88151 (see crbug.com/85296) - Fix user-after-free error with ObserverList. The problem is that if an ObserverListBase::Iterator is on the stack and one of the observers deletes the object holding the list, Iterator's destructor will use the deleted list.

BUG=84919
Review URL: http://codereview.chromium.org/7127001

TBR=jam@chromium.org
Review URL: http://codereview.chromium.org/7134008

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@88284 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 7 insertions, 11 deletions

diff --git a/base/observer_list.h b/base/observer_list.h
index d30cc6e..b8c2ae4 100644
--- a/base/observer_list.h
+++ b/base/observer_list.h
@@ -12,7 +12,6 @@
 
 #include "base/basictypes.h"
 #include "base/logging.h"
-#include "base/memory/weak_ptr.h"
 
 ///////////////////////////////////////////////////////////////////////////////
 //
@@ -62,8 +61,7 @@ template <typename ObserverType>
 class ObserverListThreadSafe;
 
 template <class ObserverType>
-class ObserverListBase
-    : public base::SupportsWeakPtr<ObserverListBase<ObserverType> > {
+class ObserverListBase {
  public:
   // Enumeration of which observers are notified.
   enum NotificationType {
@@ -81,23 +79,21 @@ class ObserverListBase
   class Iterator {
    public:
     Iterator(ObserverListBase<ObserverType>& list)
-        : list_(list.AsWeakPtr()),
+        : list_(list),
           index_(0),
           max_index_(list.type_ == NOTIFY_ALL ?
                      std::numeric_limits<size_t>::max() :
                      list.observers_.size()) {
-      ++list_->notify_depth_;
+      ++list_.notify_depth_;
     }
 
     ~Iterator() {
-      if (list_ && --list_->notify_depth_ == 0)
-        list_->Compact();
+      if (--list_.notify_depth_ == 0)
+        list_.Compact();
     }
 
     ObserverType* GetNext() {
-      if (!list_)
-        return NULL;
-      ListType& observers = list_->observers_;
+      ListType& observers = list_.observers_;
       // Advance if the current element is null
       size_t max_index = std::min(max_index_, observers.size());
       while (index_ < max_index && !observers[index_])
@@ -106,7 +102,7 @@ class ObserverListBase
     }
 
    private:
-    base::WeakPtr<ObserverListBase<ObserverType> > list_;
+    ObserverListBase<ObserverType>& list_;
     size_t index_;
     size_t max_index_;
   };