Fixes use after free in HWNDMessageHandler

msg_handled_ should only be set if ref is this is still valid.

BUG=374320
TEST=none
R=ben@chromium.org

Review URL: https://codereview.chromium.org/296993004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@272460 0039d316-1c4b-4281-b951-d872f2087c98

ui/views/win/hwnd_message_handler.h

@@ -78,10 +78,12 @@ const int WM_NCUAHDRAWFRAME = 0xAF;
                             LPARAM l_param, \
                             LRESULT& l_result, \
                             DWORD msg_map_id = 0) { \
+    base::WeakPtr<HWNDMessageHandler> ref(weak_factory_.GetWeakPtr()); \
     BOOL old_msg_handled = msg_handled_; \
     BOOL ret = _ProcessWindowMessage(hwnd, msg, w_param, l_param, l_result, \
                                      msg_map_id); \
-    msg_handled_ = old_msg_handled; \
+    if (ref.get()) \
+      msg_handled_ = old_msg_handled; \
     return ret; \
   } \
   BOOL _ProcessWindowMessage(HWND hWnd, \