From 7702cc10904e396d27962babcca2755b1ac68020 Mon Sep 17 00:00:00 2001
From: Cheng Zhao <zcbenz@gmail.com>
Date: Fri, 13 Jul 2018 17:28:23 +0900
Subject: [PATCH] fix: don't invoke callback after FrameSubscriber is destroyed

---
 atom/browser/api/frame_subscriber.cc | 5 +++--
 atom/browser/api/frame_subscriber.h  | 3 +++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/atom/browser/api/frame_subscriber.cc b/atom/browser/api/frame_subscriber.cc
index 5c49e688976a..4b1234d5677e 100644
--- a/atom/browser/api/frame_subscriber.cc
+++ b/atom/browser/api/frame_subscriber.cc
@@ -26,7 +26,8 @@ FrameSubscriber::FrameSubscriber(v8::Isolate* isolate,
     : content::WebContentsObserver(web_contents),
       isolate_(isolate),
       callback_(callback),
-      only_dirty_(only_dirty) {}
+      only_dirty_(only_dirty),
+      weak_ptr_factory_(this) {}
 
 FrameSubscriber::~FrameSubscriber() = default;
 
@@ -64,7 +65,7 @@ void FrameSubscriber::DidReceiveCompositorFrame() {
 
   view->CopyFromSurface(
       gfx::Rect(), view->GetViewBounds().size(),
-      base::BindOnce(&FrameSubscriber::Done, base::Unretained(this),
+      base::BindOnce(&FrameSubscriber::Done, weak_ptr_factory_.GetWeakPtr(),
                      GetDamageRect()));
 }
 
diff --git a/atom/browser/api/frame_subscriber.h b/atom/browser/api/frame_subscriber.h
index 390b54f58cc9..3de976f30511 100644
--- a/atom/browser/api/frame_subscriber.h
+++ b/atom/browser/api/frame_subscriber.h
@@ -8,6 +8,7 @@
 #include "content/public/browser/web_contents.h"
 
 #include "base/callback.h"
+#include "base/memory/weak_ptr.h"
 #include "components/viz/common/frame_sinks/copy_output_result.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "ui/gfx/image/image.h"
@@ -39,6 +40,8 @@ class FrameSubscriber : public content::WebContentsObserver {
   FrameCaptureCallback callback_;
   bool only_dirty_;
 
+  base::WeakPtrFactory<FrameSubscriber> weak_ptr_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(FrameSubscriber);
 };