Fix crash in web workers when entangled port sender is null.

chrome/browser/worker_host/message_port_dispatcher.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/worker_host/message_port_dispatcher.h"
 
 #include "base/callback.h"
 #include "base/singleton.h"
 #include "chrome/browser/browser_thread.h"
 #include "chrome/browser/renderer_host/resource_message_filter.h"
@@ skipping 181 matching lines @@
       sent_ports[i]->sender = entangled_port.sender;
 
       // Update the entry for the sent port as it can be in a different process.
       sent_ports[i]->route_id = new_routing_ids[i];
     }
 
     // Now send the message to the entangled port.
     IPC::Message* ipc_msg = new WorkerProcessMsg_Message(
         entangled_port.route_id, message, sent_message_port_ids,
         new_routing_ids);
-    entangled_port.sender->Send(ipc_msg);
+

[levin, 2010/11/18 05:06:40]

John is the right person to review this and can hopefully check the code for
places with similar problems.

fwiw, this change has a memory leak.

A simple fix is to move this allocation inside of " if (entangled_port.sender)"
with entangled_port.sender->Send(ipc_msg);

[inferno, 2010/11/18 06:12:52]

Done.

+    if (entangled_port.sender)
+      entangled_port.sender->Send(ipc_msg);
   }
 }
 
 void MessagePortDispatcher::OnQueueMessages(int message_port_id) {
   if (!message_ports_.count(message_port_id)) {
     NOTREACHED();
     return;
   }
 
   MessagePort& port = message_ports_[message_port_id];
@@ skipping 66 matching lines @@
   int entangled_id = erase_item->second.entangled_message_port_id;
   if (entangled_id != MSG_ROUTING_NONE) {
     // Do the disentanglement (and be paranoid about the other side existing
     // just in case something unusual happened during entanglement).
     if (message_ports_.count(entangled_id)) {
       message_ports_[entangled_id].entangled_message_port_id = MSG_ROUTING_NONE;
     }
   }
   message_ports_.erase(erase_item);
 }