Crash fix: Ignore mojo Create() calls after RFH is dead.

chrome/browser/media/cast_remoting_connector.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/media/cast_remoting_connector.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/stringprintf.h"
 #include "chrome/browser/media/cast_remoting_connector_messaging.h"
 #include "chrome/browser/media/cast_remoting_sender.h"
 #include "chrome/browser/media/router/media_router.h"
 #include "chrome/browser/media/router/media_router_factory.h"
 #include "chrome/browser/media/router/media_source_helper.h"
 #include "chrome/browser/media/router/route_message.h"
 #include "chrome/browser/media/router/route_message_observer.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 
 using content::BrowserThread;
 using media::mojom::RemotingStartFailReason;
 using media::mojom::RemotingStopReason;
 
 using Messaging = CastRemotingConnectorMessaging;
 
 class CastRemotingConnector::FrameRemoterFactory
     : public media::mojom::RemoterFactory {
  public:
-  // |render_frame_host| represents the source render frame.
+  // |render_frame_host| represents the source render frame. It could be
+  // destroyed at any time and so the process/routing IDs are used as a weak
+  // reference.
   explicit FrameRemoterFactory(content::RenderFrameHost* render_frame_host)
-      : host_(render_frame_host) {
-    DCHECK(host_);
-  }
+      : render_frame_process_id_(render_frame_host->GetProcess()->GetID()),
+        render_frame_routing_id_(render_frame_host->GetRoutingID()) {}
   ~FrameRemoterFactory() final {}
 
   void Create(media::mojom::RemotingSourcePtr source,
               media::mojom::RemoterRequest request) final {
-    CastRemotingConnector::Get(content::WebContents::FromRenderFrameHost(host_))
-        ->CreateBridge(std::move(source), std::move(request));
+    auto* const host = content::RenderFrameHost::FromID(
+        render_frame_process_id_, render_frame_routing_id_);
+    if (!host)
+      return;
+    auto* const contents = content::WebContents::FromRenderFrameHost(host);
+    if (!contents)
+      return;
+    CastRemotingConnector::Get(contents)->CreateBridge(std::move(source),
+                                                       std::move(request));
   }
 
  private:
-  content::RenderFrameHost* const host_;
+  const int render_frame_process_id_;
+  const int render_frame_routing_id_;
 
   DISALLOW_COPY_AND_ASSIGN(FrameRemoterFactory);
 };
 
 class CastRemotingConnector::RemotingBridge : public media::mojom::Remoter {
  public:
   // Constructs a "bridge" to delegate calls between the given |source| and
   // |connector|. |connector| must be valid at the time of construction, but is
   // otherwise a weak pointer that can become invalid during the lifetime of a
   // RemotingBridge.
@@ skipping 103 matching lines @@
         media_router::MediaSourceForTabContentRemoting(contents).id());
     contents->SetUserData(kUserDataKey, connector);
   }
   return connector;
 }
 
 // static
 void CastRemotingConnector::CreateRemoterFactory(
     content::RenderFrameHost* render_frame_host,
     media::mojom::RemoterFactoryRequest request) {
+  DCHECK(render_frame_host);
   mojo::MakeStrongBinding(
       base::MakeUnique<FrameRemoterFactory>(render_frame_host),
       std::move(request));
 }
 
 CastRemotingConnector::CastRemotingConnector(
     media_router::MediaRouter* router,
     const media_router::MediaSource::Id& media_source_id)
     : media_router::MediaRoutesObserver(router),
       media_source_id_(media_source_id),
@@ skipping 321 matching lines @@
         media_router::MediaRoutesObserver::router(), route.media_route_id(),
         this));
     // TODO(miu): In the future, scan the route ID for sink capabilities
     // properties and pass these to the source in the OnSinkAvailable()
     // notification.
     for (RemotingBridge* notifyee : bridges_)
       notifyee->OnSinkAvailable();
     break;
   }
 }