An exprimental fix for Bug 65940....

chrome/common/child_thread.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/child_thread.h"
 
 #include "base/message_loop.h"
 #include "base/string_util.h"
 #include "base/command_line.h"
 #include "chrome/common/child_process.h"
@@ skipping 53 matching lines @@
     notification_service_.reset(new NotificationService);
 }
 
 ChildThread::~ChildThread() {
 #ifdef IPC_MESSAGE_LOG_ENABLED
   IPC::Logging::current()->SetIPCSender(NULL);
 #endif
 
   channel_->RemoveFilter(sync_message_filter_.get());
 
+  // Close this channel before resetting the message loop attached to it so
+  // the message loop can call ChannelProxy::Context::OnChannelClosed(), which
+  // releases the reference count to this channel.
+  channel_->Close();
+
   // The ChannelProxy object caches a pointer to the IPC thread, so need to
   // reset it as it's not guaranteed to outlive this object.
   // NOTE: this also has the side-effect of not closing the main IPC channel to
   // the browser process.  This is needed because this is the signal that the
   // browser uses to know that this process has died, so we need it to be alive
   // until this process is shut down, and the OS closes the handle
   // automatically.  We used to watch the object handle on Windows to do this,
   // but it wasn't possible to do so on POSIX.
   channel_->ClearIPCMessageLoop();
 }
@@ skipping 106 matching lines @@
     MessageLoop::current()->Quit();
     return;
   }
 
   // The child process shutdown sequence is a request response based mechanism,
   // where we send out an initial feeler request to the child process host
   // instance in the browser to verify if it's ok to shutdown the child process.
   // The browser then sends back a response if it's ok to shutdown.
   Send(new PluginProcessHostMsg_ShutdownRequest);
 }