AppCache: Use WeakPtr<> to fix a potential uaf bug.

BUG=554908

Review URL: https://codereview.chromium.org/1441683004

Cr-Commit-Position: refs/heads/master@{#359930}

2 files changed, 8 insertions, 4 deletions

diff --git a/content/browser/appcache/appcache_dispatcher_host.cc b/content/browser/appcache/appcache_dispatcher_host.cc
index e35610f..6a864f7 100644
--- a/content/browser/appcache/appcache_dispatcher_host.cc
+++ b/content/browser/appcache/appcache_dispatcher_host.cc
@@ -19,7 +19,8 @@ AppCacheDispatcherHost::AppCacheDispatcherHost(
     : BrowserMessageFilter(AppCacheMsgStart),
       appcache_service_(appcache_service),
       frontend_proxy_(this),
-      process_id_(process_id) {
+      process_id_(process_id),
+      weak_factory_(this) {
 }
 
 void AppCacheDispatcherHost::OnChannelConnected(int32 peer_pid) {
@@ -28,13 +29,13 @@ void AppCacheDispatcherHost::OnChannelConnected(int32 peer_pid) {
         appcache_service_.get(), &frontend_proxy_, process_id_);
     get_status_callback_ =
         base::Bind(&AppCacheDispatcherHost::GetStatusCallback,
-                   base::Unretained(this));
+                    weak_factory_.GetWeakPtr());
     start_update_callback_ =
         base::Bind(&AppCacheDispatcherHost::StartUpdateCallback,
-                   base::Unretained(this));
+                    weak_factory_.GetWeakPtr());
     swap_cache_callback_ =
         base::Bind(&AppCacheDispatcherHost::SwapCacheCallback,
-                   base::Unretained(this));
+                    weak_factory_.GetWeakPtr());
   }
 }
 
diff --git a/content/browser/appcache/appcache_dispatcher_host.h b/content/browser/appcache/appcache_dispatcher_host.h
index 30d2f86..f8909a8 100644
--- a/content/browser/appcache/appcache_dispatcher_host.h
+++ b/content/browser/appcache/appcache_dispatcher_host.h
@@ -9,6 +9,7 @@
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
+#include "base/memory/weak_ptr.h"
 #include "base/process/process.h"
 #include "content/browser/appcache/appcache_backend_impl.h"
 #include "content/browser/appcache/appcache_frontend_proxy.h"
@@ -69,6 +70,8 @@ class AppCacheDispatcherHost : public BrowserMessageFilter {
   // The corresponding ChildProcessHost object's id().
   int process_id_;
 
+  base::WeakPtrFactory<AppCacheDispatcherHost> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(AppCacheDispatcherHost);
 };