Fix a memory leak in ExtensionMessageService.

chrome/browser/extensions/extension_message_service.h

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_EXTENSIONS_EXTENSION_MESSAGE_SERVICE_H_
 #define CHROME_BROWSER_EXTENSIONS_EXTENSION_MESSAGE_SERVICE_H_
 
 #include <map>
 #include <set>
 #include <string>
 
-#include "base/linked_ptr.h"
 #include "base/lock.h"
 #include "base/ref_counted.h"
 #include "chrome/common/notification_registrar.h"
 #include "chrome/browser/extensions/extension_devtools_manager.h"
 #include "ipc/ipc_message.h"
 
 class MessageLoop;
 class Profile;
 class RenderProcessHost;
 class ResourceMessageFilter;
@@ skipping 100 matching lines @@
   // Same as above, but opens a channel to the tab with the given ID.  Messages
   // are restricted to that tab, so if there are multiple tabs in that process,
   // only the targeted tab will receive messages.
   int OpenChannelToTab(int routing_id, int tab_id,
                        const std::string& extension_id,
                        const std::string& channel_name,
                        ResourceMessageFilter* source);
 
  private:
   // A map of channel ID to its channel object.
-  typedef std::map<int, linked_ptr<MessageChannel> > MessageChannelMap;
+  typedef std::map<int, MessageChannel*> MessageChannelMap;

[Erik does not do reviews, 2009/11/04 17:00:33]

I think I'm missing something about the change away from linked_ptr.  Isn't this
equivalent to the old code (but less automatic)?

[Matt Perry, 2009/11/04 18:47:47]

Yes, theoretically. This is the "grasping at straws" part. I'm testing if
there's something about my usage of linked_ptr that may have caused a double
free. I couldn't find anything else in this file that was suspect. Json parsing
and serialization held up to fuzzing under purify.

 
   // Allocates a pair of port ids.
   // NOTE: this can be called from any thread.
   void AllocatePortIdPair(int* port1, int* port2);
 
   void CloseChannelImpl(MessageChannelMap::iterator channel_iter, int port_id,
                         bool notify_other_port);
 
   // --- UI thread only:
 
@@ skipping 45 matching lines @@
   int next_port_id_;
 
   // Protects the next_port_id_ variable, since it can be
   // used on the IO thread or the UI thread.
   Lock next_port_id_lock_;
 
   DISALLOW_COPY_AND_ASSIGN(ExtensionMessageService);
 };
 
 #endif  // CHROME_BROWSER_EXTENSIONS_EXTENSION_MESSAGE_SERVICE_H_