Fix UdpPacketSocket to handle callbacks after the socket is destroyed.

remoting/client/plugin/pepper_packet_socket_factory.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/client/plugin/pepper_packet_socket_factory.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
+#include "base/memory/weak_ptr.h"
 #include "net/base/io_buffer.h"
 #include "ppapi/cpp/private/net_address_private.h"
 #include "ppapi/cpp/private/udp_socket_private.h"
 #include "remoting/client/plugin/pepper_util.h"
 #include "third_party/libjingle/source/talk/base/asyncpacketsocket.h"
 
 namespace remoting {
 
 namespace {
 
 // Size of the buffer to allocate for RecvFrom().
 const int kReceiveBufferSize = 65536;
 
 // Maximum amount of data in the send buffers. This is necessary to
 // prevent out-of-memory crashes if the caller sends data faster than
 // Pepper's UDP API can handle it. This maximum should never be
 // reached under normal conditions.
 const int kMaxSendBufferSize = 256 * 1024;
 
 class UdpPacketSocket : public talk_base::AsyncPacketSocket {
  public:
   explicit UdpPacketSocket(const pp::InstanceHandle& instance);
   virtual ~UdpPacketSocket();
 
   // |min_port| and |max_port| are set to zero if the port number
-  // |should be assigned by the OS.
+  // should be assigned by the OS.
   bool Init(const talk_base::SocketAddress& local_address,
             int min_port,
             int max_port);
 
   // talk_base::AsyncPacketSocket interface.
   virtual talk_base::SocketAddress GetLocalAddress() const;
   virtual talk_base::SocketAddress GetRemoteAddress() const;
   virtual int Send(const void* data, size_t data_size);
   virtual int SendTo(const void* data,
                      size_t data_size,
@@ skipping 35 matching lines @@
   // the port number is assigned by OS.
   uint16_t min_port_;
   uint16_t max_port_;
 
   std::vector<char> receive_buffer_;
 
   bool send_pending_;
   std::list<PendingPacket> send_queue_;
   int send_queue_size_;
 
+  base::WeakPtrFactory<UdpPacketSocket> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(UdpPacketSocket);
 };
 
 UdpPacketSocket::PendingPacket::PendingPacket(
     const void* buffer,
     int buffer_size,
     const PP_NetAddress_Private& address)
     : data(new net::IOBufferWithSize(buffer_size)),
       address(address) {
   memcpy(data->data(), buffer, buffer_size);
 }
 
 UdpPacketSocket::UdpPacketSocket(const pp::InstanceHandle& instance)
     : socket_(instance),
       state_(STATE_CLOSED),
       error_(0),
       min_port_(0),
       max_port_(0),
       send_pending_(false),
-      send_queue_size_(0) {
+      send_queue_size_(0),
+      ALLOW_THIS_IN_INITIALIZER_LIST(weak_factory_(this)) {
 }
 
 UdpPacketSocket::~UdpPacketSocket() {
   Close();
 }
 
 bool UdpPacketSocket::Init(const talk_base::SocketAddress& local_address,
                            int min_port,
                            int max_port) {
   if (socket_.is_null()) {
     return false;
   }
 
   local_address_ = local_address;
   max_port_ = max_port;
   min_port_ = min_port;
 
   PP_NetAddress_Private pp_local_address;
   if (!SocketAddressToPpAddressWithPort(local_address_, &pp_local_address,
                                         min_port_)) {
     return false;
   }
 
   int result = socket_.Bind(&pp_local_address, PpCompletionCallback(
-      base::Bind(&UdpPacketSocket::OnBindCompleted, base::Unretained(this))));
+      base::Bind(&UdpPacketSocket::OnBindCompleted,
+                 weak_factory_.GetWeakPtr())));
   DCHECK_EQ(result, PP_OK_COMPLETIONPENDING);
   state_ = STATE_BINDING;
 
   return true;
 }
 
 void UdpPacketSocket::OnBindCompleted(int result) {
   DCHECK(state_ == STATE_BINDING || state_ == STATE_CLOSED);
 
   if (result == PP_ERROR_ABORTED) {
@@ skipping 17 matching lines @@
   }
 
   if (min_port_ < max_port_) {
     // Try to bind to the next available port.
     ++min_port_;
     PP_NetAddress_Private pp_local_address;
     if (SocketAddressToPpAddressWithPort(local_address_, &pp_local_address,
                                          min_port_)) {
       int result = socket_.Bind(&pp_local_address, PpCompletionCallback(
           base::Bind(&UdpPacketSocket::OnBindCompleted,
-                     base::Unretained(this))));
+                     weak_factory_.GetWeakPtr())));
       DCHECK_EQ(result, PP_OK_COMPLETIONPENDING);
     }
   } else {
     LOG(ERROR) << "Failed to bind UDP socket: " << result;
   }
 }
 
 talk_base::SocketAddress UdpPacketSocket::GetLocalAddress() const {
   DCHECK_EQ(state_, STATE_BOUND);
   return local_address_;
@@ skipping 68 matching lines @@
 }
 
 void UdpPacketSocket::DoSend() {
   if (send_pending_ || send_queue_.empty())
     return;
 
   int result = socket_.SendTo(
       send_queue_.front().data->data(), send_queue_.front().data->size(),
       &send_queue_.front().address,
       PpCompletionCallback(base::Bind(&UdpPacketSocket::OnSendCompleted,
-                                      base::Unretained(this))));
+                                      weak_factory_.GetWeakPtr())));
   DCHECK_EQ(result, PP_OK_COMPLETIONPENDING);
   send_pending_ = true;
 }
 
 void UdpPacketSocket::OnSendCompleted(int result) {
   if (result == PP_ERROR_ABORTED) {
     // Send is aborted when the socket is being destroyed.
     // |send_queue_| may be already destroyed, it's not safe to access
     // it here.
     return;
@@ skipping 26 matching lines @@
   send_queue_size_ -= send_queue_.front().data->size();
   send_queue_.pop_front();
   DoSend();
 }
 
 void UdpPacketSocket::DoRead() {
   receive_buffer_.resize(kReceiveBufferSize);
   int result = socket_.RecvFrom(
       &receive_buffer_[0], receive_buffer_.size(),
       PpCompletionCallback(base::Bind(&UdpPacketSocket::OnReadCompleted,
-                                      base::Unretained(this))));
+                                      weak_factory_.GetWeakPtr())));
   DCHECK_EQ(result, PP_OK_COMPLETIONPENDING);
 }
 
 void UdpPacketSocket::OnReadCompleted(int result) {
   HandleReadResult(result);
   if (result > 0) {
     DoRead();
   }
 }
 
@@ skipping 50 matching lines @@
       const talk_base::SocketAddress& remote_address,
       const talk_base::ProxyInfo& proxy_info,
       const std::string& user_agent,
       bool ssl) {
   // We don't use TCP sockets for remoting connections.
   NOTREACHED();
   return NULL;
 }
 
 }  // namespace remoting