mus: Fix a couple of use-after-free issues.

BUG=none

Review URL: https://codereview.chromium.org/1582613006

Cr-Commit-Position: refs/heads/master@{#369399}

content/browser/mojo/mojo_shell_client_host.cc

@@ -102,7 +102,8 @@ class PIDSender : public RenderProcessHostObserver {
     host_->AddObserver(this);
   }
   ~PIDSender() override {
-    host_->RemoveObserver(this);
+    if (host_)
+      host_->RemoveObserver(this);
   }
 
  private:
@@ -112,6 +113,11 @@ class PIDSender : public RenderProcessHostObserver {
     delete this;
   }
 
+  void RenderProcessHostDestroyed(RenderProcessHost* host) override {
+    DCHECK_EQ(host_, host);
+    host_ = nullptr;
+  }
+
   RenderProcessHost* host_;
   mojo::shell::mojom::PIDReceiverPtr pid_receiver_;
 

ui/views/mus/platform_window_mus.cc

@@ -146,8 +146,15 @@ void PlatformWindowMus::SetShowState(mus::mojom::ShowState show_state) {
 void PlatformWindowMus::OnWindowDestroyed(mus::Window* window) {
   DCHECK_EQ(mus_window_, window);
   mus_window_destroyed_ = true;
+#ifndef NDEBUG
+  weak_factory_.reset(new base::WeakPtrFactory<PlatformWindowMus>(this));
+  base::WeakPtr<PlatformWindowMus> weak_ptr = weak_factory_->GetWeakPtr();
+#endif
   delegate_->OnClosed();
-  mus_window_ = nullptr;
+  // |this| has been destroyed at this point.
+#ifndef NDEBUG
+  DCHECK(!weak_ptr);
+#endif
 }
 
 void PlatformWindowMus::OnWindowBoundsChanged(mus::Window* window,

ui/views/mus/platform_window_mus.h

@@ -82,6 +82,10 @@ class VIEWS_MUS_EXPORT PlatformWindowMus
   // True if OnWindowDestroyed() has been received.
   bool mus_window_destroyed_;
 
+#ifndef NDEBUG
+  scoped_ptr<base::WeakPtrFactory<PlatformWindowMus>> weak_factory_;
+#endif
+
   DISALLOW_COPY_AND_ASSIGN(PlatformWindowMus);
 };