Fix crash in WorkerTest.MultipleTabsQueuedSharedWorker. I could get this consistently when running …

content/browser/worker_host/worker_service_impl.cc

Index: content/browser/worker_host/worker_service_impl.cc
===================================================================
--- content/browser/worker_host/worker_service_impl.cc	(revision 148517)
+++ content/browser/worker_host/worker_service_impl.cc	(working copy)
@@ -62,6 +62,17 @@
     }
   }
 
+  for (WorkerProcessHost::Instances::iterator i =

[Andrew T Wilson (Slow), 2012/07/26 17:20:40]

Can we clarify what this is doing? Looks like we're blowing away pending shared
workers if there aren't any more filters (parent documents) associated with it?

I guess I'm confused about the difference between what we do here, and what we
do in the next for loop.

[jam, 2012/07/26 17:26:59]

I don't claim to understand the worker document set concept, so hard for me to
compare. I think the main issue here is that the filter* is stored in two
places, both in the document_set() below, but also directly on the
WorkerInstance itself. When running the test in VS, and with a few printfs, I
could see that pending_shared_workers_ had objects which pointed to deleted
filters.

+           pending_shared_workers_.begin();
+       i != pending_shared_workers_.end(); ) {
+     i->RemoveFilters(filter);
+     if (i->NumFilters() == 0) {
+      i = pending_shared_workers_.erase(i);
+    } else {
+      ++i;
+    }
+  }
+
   // Also, see if that process had any pending shared workers.
   for (WorkerProcessHost::Instances::iterator iter =
            pending_shared_workers_.begin();