Fix a memory leak in ResourceDispatcher...

chrome/common/resource_dispatcher.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "chrome/common/resource_dispatcher.h"
 
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
@@ skipping 258 matching lines @@
   if (!message.ReadInt(&iter, &request_id)) {
     NOTREACHED() << "malformed resource message";
     return true;
   }
 
   PendingRequestList::iterator it = pending_requests_.find(request_id);
   if (it == pending_requests_.end()) {
     // This might happen for kill()ed requests on the webkit end, so perhaps it
     // shouldn't be a warning...
     DLOG(WARNING) << "Got response for a nonexistant or finished request";
+    // Release resources in the message if it is a data message.
+    ReleaseResourcesInDataMessage(message);
     return true;
   }
 
   PendingRequestInfo& request_info = it->second;
   if (request_info.is_deferred) {
     request_info.deferred_message_queue.push_back(new IPC::Message(message));
     return true;
   }
   // Make sure any deferred messages are dispatched before we dispatch more.
   if (!request_info.deferred_message_queue.empty())
@@ skipping 171 matching lines @@
   // Compute a unique request_id for this renderer process.
   int id = MakeRequestID();
   pending_requests_[id] = PendingRequestInfo(callback, resource_type);
   return id;
 }
 
 bool ResourceDispatcher::RemovePendingRequest(int request_id) {
   PendingRequestList::iterator it = pending_requests_.find(request_id);
   if (it == pending_requests_.end())
     return false;
+
+  // Iterate through the deferred message queue and clean up the messages.
+  PendingRequestInfo& request_info = it->second;
+  MessageQueue& q = request_info.deferred_message_queue;
+  while (!q.empty()) {
+    IPC::Message* m = q.front();
+    ReleaseResourcesInDataMessage(*m);
+    q.pop_front();
+    delete m;
+  }
+
   pending_requests_.erase(it);
   return true;
 }
 
 void ResourceDispatcher::SetDefersLoading(int request_id, bool value) {
   PendingRequestList::iterator it = pending_requests_.find(request_id);
   if (it == pending_requests_.end()) {
     NOTREACHED() << "unknown request";
     return;
   }
@@ skipping 72 matching lines @@
     case ViewMsg_Resource_DataReceived::ID:
     case ViewMsg_Resource_RequestComplete::ID:
       return true;
 
     default:
       break;
   }
 
   return false;
 }
+
+void ResourceDispatcher::ReleaseResourcesInDataMessage(
+    const IPC::Message& message) {
+  void* iter = NULL;
+  int request_id;
+  if (!message.ReadInt(&iter, &request_id)) {
+    NOTREACHED() << "malformed resource message";
+    return;
+  }
+
+  // If the message contains a shared memory handle, we should close the
+  // handle or there will be a memory leak.
+  if (message.type() == ViewMsg_Resource_DataReceived::ID) {
+    base::SharedMemoryHandle shm_handle;
+    if (IPC::ParamTraits<base::SharedMemoryHandle>::Read(&message,
+                                                         &iter,
+                                                         &shm_handle)) {
+      base::SharedMemory::CloseHandle(shm_handle);
+    }
+  }
+}