Fix user-after-free error with ObserverList. The problem is that if an ObserverListBase::Iterato...

content/browser/renderer_host/render_view_host.cc

Index: content/browser/renderer_host/render_view_host.cc
===================================================================
--- content/browser/renderer_host/render_view_host.cc	(revision 87996)
+++ content/browser/renderer_host/render_view_host.cc	(working copy)
@@ -606,16 +606,11 @@
     if (!content::SwappedOutMessages::CanHandleWhileSwappedOut(msg))
       return true;
 
-  {
-    // delegate_->OnMessageReceived can end up deleting |this|, in which case
-    // the destructor for ObserverListBase::Iterator would access the deleted
-    // observers_.
-    ObserverListBase<RenderViewHostObserver>::Iterator it(observers_);
-    RenderViewHostObserver* observer;
-    while ((observer = it.GetNext()) != NULL)
-      if (observer->OnMessageReceived(msg))
-        return true;
-  }
+  ObserverListBase<RenderViewHostObserver>::Iterator it(observers_);
+  RenderViewHostObserver* observer;
+  while ((observer = it.GetNext()) != NULL)

[Evan Martin, 2011/06/07 18:01:51]

curlies on this while loop

+    if (observer->OnMessageReceived(msg))
+      return true;
 
   if (delegate_->OnMessageReceived(msg))
     return true;