Fix a crash if GetPrinterCapsAndDefaults returns after the calling printer is deleted.

There was a crash when disconnecting from a machine via Windows RDP.  RDP injects client machine printers into the host machine.  GetPrinterCapsAndDefaults blocks on these printers.  When the user disconnects, the printer is deleted and then GetPrinterCapsAndDefaults returns.  The failure handler fires and attempts to access the now-freed PrinterJobHandler that was passed with the callback resulting in a crash.

The solution is to pass a WeakPtr to the callback so that if the PrinterJobHandler is destroyed the
callback wont fire.

BUG=122996
TEST=Verify bug.


Review URL: http://codereview.chromium.org/10079017

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@132283 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 6 insertions, 3 deletions

diff --git a/chrome/service/cloud_print/printer_job_handler.cc b/chrome/service/cloud_print/printer_job_handler.cc
index b084c06..d7f562d 100644
--- a/chrome/service/cloud_print/printer_job_handler.cc
+++ b/chrome/service/cloud_print/printer_job_handler.cc
@@ -54,7 +54,8 @@ PrinterJobHandler::PrinterJobHandler(
       shutting_down_(false),
       job_check_pending_(false),
       printer_update_pending_(true),
-      task_in_progress_(false) {
+      task_in_progress_(false),
+      ALLOW_THIS_IN_INITIALIZER_LIST(weak_ptr_factory_(this)) {
 }
 
 bool PrinterJobHandler::Initialize() {
@@ -169,7 +170,7 @@ bool PrinterJobHandler::UpdatePrinterInfo() {
   print_system_->GetPrinterCapsAndDefaults(
       printer_info.printer_name.c_str(),
       base::Bind(&PrinterJobHandler::OnReceivePrinterCaps,
-                 base::Unretained(this)));
+                 weak_ptr_factory_.GetWeakPtr()));
 
   // While we are waiting for the data, pretend we have work to do and return
   // true.
diff --git a/chrome/service/cloud_print/printer_job_handler.h b/chrome/service/cloud_print/printer_job_handler.h
index a9de178..a818c83 100644
--- a/chrome/service/cloud_print/printer_job_handler.h
+++ b/chrome/service/cloud_print/printer_job_handler.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -12,6 +12,7 @@
 
 #include "base/file_path.h"
 #include "base/memory/ref_counted.h"
+#include "base/memory/weak_ptr.h"
 #include "base/message_loop_proxy.h"
 #include "base/threading/thread.h"
 #include "base/time.h"
@@ -289,6 +290,7 @@ class PrinterJobHandler : public base::RefCountedThreadSafe<PrinterJobHandler>,
   JobStatusUpdaterList job_status_updater_list_;
 
   base::TimeTicks last_job_fetch_time_;
+  base::WeakPtrFactory<PrinterJobHandler> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(PrinterJobHandler);
 };