Prevent crash in MessagePopupCollection from use-after-free.

Prevent crash from use after free by using weak pointers
so that asynchronous destruction of Widgets doesn't cause
problems.

BUG=222095

Review URL: https://chromiumcodereview.appspot.com/12794008

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@189227 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 11 insertions, 6 deletions

diff --git a/ui/message_center/views/message_popup_collection.cc b/ui/message_center/views/message_popup_collection.cc
index 8e7351a..389efb5 100644
--- a/ui/message_center/views/message_popup_collection.cc
+++ b/ui/message_center/views/message_popup_collection.cc
@@ -7,6 +7,7 @@
 #include <set>
 
 #include "base/bind.h"
+#include "base/memory/weak_ptr.h"
 #include "base/timer.h"
 #include "ui/gfx/screen.h"
 #include "ui/message_center/message_center.h"
@@ -25,7 +26,7 @@ namespace message_center {
 class ToastContentsView : public views::WidgetDelegateView {
  public:
   ToastContentsView(const Notification* notification,
-                    MessagePopupCollection* collection)
+                    base::WeakPtr<MessagePopupCollection> collection)
       : collection_(collection) {
     DCHECK(collection_);
 
@@ -108,11 +109,13 @@ class ToastContentsView : public views::WidgetDelegateView {
 
   // Overridden from views::View:
   virtual void OnMouseEntered(const ui::MouseEvent& event) OVERRIDE {
-    collection_->OnMouseEntered();
+    if (collection_)
+      collection_->OnMouseEntered();
   }
 
   virtual void OnMouseExited(const ui::MouseEvent& event) OVERRIDE {
-    collection_->OnMouseExited();
+    if (collection_)
+      collection_->OnMouseExited();
   }
 
   virtual void Layout() OVERRIDE {
@@ -132,7 +135,7 @@ class ToastContentsView : public views::WidgetDelegateView {
   base::TimeDelta delay_;
   base::Time start_time_;
   base::OneShotTimer<views::Widget> timer_;
-  MessagePopupCollection* collection_;
+  base::WeakPtr<MessagePopupCollection> collection_;
 
   DISALLOW_COPY_AND_ASSIGN(ToastContentsView);
 };
@@ -198,7 +201,7 @@ void MessagePopupCollection::UpdatePopups() {
       // image loads.
       toast_iter->second->SetContents(view);
     } else {
-      ToastContentsView* toast = new ToastContentsView(*iter, this);
+      ToastContentsView* toast = new ToastContentsView(*iter, AsWeakPtr());
       widget = toast->CreateWidget(context_);
       toast->SetContents(view);
       widget->AddObserver(this);
diff --git a/ui/message_center/views/message_popup_collection.h b/ui/message_center/views/message_popup_collection.h
index b85bcf0..699f2ca 100644
--- a/ui/message_center/views/message_popup_collection.h
+++ b/ui/message_center/views/message_popup_collection.h
@@ -10,6 +10,7 @@
 
 #include "base/compiler_specific.h"
 #include "base/gtest_prod_util.h"
+#include "base/memory/weak_ptr.h"
 #include "ui/gfx/native_widget_types.h"
 #include "ui/message_center/message_center_export.h"
 #include "ui/views/widget/widget_observer.h"
@@ -33,7 +34,8 @@ class ToastContentsView;
 // contents of each toast are for the message center and layout strategy would
 // be slightly different.
 class MESSAGE_CENTER_EXPORT MessagePopupCollection
-    : public views::WidgetObserver {
+    : public views::WidgetObserver,
+      public base::SupportsWeakPtr<MessagePopupCollection> {
  public:
   // |context| specifies the context to create toast windows. It can be NULL
   // for non-aura environment. See comments in ui/views/widget/widget.h.