2 files changed, 14 insertions, 4 deletions
diff --git a/chrome/browser/speech/tts_message_filter.cc b/chrome/browser/speech/tts_message_filter.cc
index 8d799fe..4925359 100644
--- a/chrome/browser/speech/tts_message_filter.cc
+++ b/chrome/browser/speech/tts_message_filter.cc
@@ -15,9 +15,14 @@ TtsMessageFilter::TtsMessageFilter(int render_process_id,
                                    content::BrowserContext* browser_context)
     : BrowserMessageFilter(TtsMsgStart),
       render_process_id_(render_process_id),
-      browser_context_(browser_context) {
+      browser_context_(browser_context),
+      weak_ptr_factory_(this) {
   CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   TtsController::GetInstance()->AddVoicesChangedDelegate(this);
+
+  // Balanced in OnChannelClosingInUIThread() to keep the ref-count be non-zero
+  // until all WeakPtr's are invalidated.
+  AddRef();
 }
 
 void TtsMessageFilter::OverrideThreadForMessage(
@@ -91,7 +96,7 @@ void TtsMessageFilter::OnSpeak(const TtsUtteranceRequest& request) {
   params.volume = request.volume;
   utterance->set_continuous_parameters(params);
 
-  utterance->set_event_delegate(this->AsWeakPtr());
+  utterance->set_event_delegate(weak_ptr_factory_.GetWeakPtr());
 
   TtsController::GetInstance()->SpeakOrEnqueue(utterance.release());
 }
@@ -159,9 +164,13 @@ void TtsMessageFilter::OnVoicesChanged() {
 void TtsMessageFilter::OnChannelClosingInUIThread() {
   CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   TtsController::GetInstance()->RemoveVoicesChangedDelegate(this);
+
+  weak_ptr_factory_.InvalidateWeakPtrs();
+  Release();  // Balanced in TtsMessageFilter().
 }
 
 TtsMessageFilter::~TtsMessageFilter() {
   CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
+  DCHECK(!weak_ptr_factory_.HasWeakPtrs());
   TtsController::GetInstance()->RemoveVoicesChangedDelegate(this);
 }
diff --git a/chrome/browser/speech/tts_message_filter.h b/chrome/browser/speech/tts_message_filter.h
index cecb2ba..8059778 100644
--- a/chrome/browser/speech/tts_message_filter.h
+++ b/chrome/browser/speech/tts_message_filter.h
@@ -17,8 +17,7 @@ class BrowserContext;
 class TtsMessageFilter
     : public content::BrowserMessageFilter,
       public UtteranceEventDelegate,
-      public VoicesChangedDelegate,
-      public base::SupportsWeakPtr<TtsMessageFilter> {
+      public VoicesChangedDelegate {
  public:
   explicit TtsMessageFilter(int render_process_id,
       content::BrowserContext* browser_context);
@@ -57,6 +56,8 @@ class TtsMessageFilter
   int render_process_id_;
   content::BrowserContext* browser_context_;
 
+  base::WeakPtrFactory<TtsMessageFilter> weak_ptr_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(TtsMessageFilter);
 };