Revert 88151 (see crbug.com/85296) - Fix user-after-free error with ObserverList. The problem is...

content/browser/renderer_host/render_view_host.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_view_host.h"
 
 #include <string>
 #include <utility>
 #include <vector>
 
@@ skipping 615 matching lines @@
 bool RenderViewHost::OnMessageReceived(const IPC::Message& msg) {
   if (!BrowserMessageFilter::CheckCanDispatchOnUI(msg, this))
     return true;
 
   // Filter out most IPC messages if this renderer is swapped out.
   // We still want to certain ACKs to keep our state consistent.
   if (is_swapped_out_)
     if (!content::SwappedOutMessages::CanHandleWhileSwappedOut(msg))
       return true;
 
-  ObserverListBase<RenderViewHostObserver>::Iterator it(observers_);
-  RenderViewHostObserver* observer;
-  while ((observer = it.GetNext()) != NULL) {
-    if (observer->OnMessageReceived(msg))
-      return true;
+  {
+    // delegate_->OnMessageReceived can end up deleting |this|, in which case
+    // the destructor for ObserverListBase::Iterator would access the deleted
+    // observers_.
+    ObserverListBase<RenderViewHostObserver>::Iterator it(observers_);
+    RenderViewHostObserver* observer;
+    while ((observer = it.GetNext()) != NULL)
+      if (observer->OnMessageReceived(msg))
+        return true;
   }
 
   if (delegate_->OnMessageReceived(msg))
     return true;
 
   bool handled = true;
   bool msg_is_ok = true;
   IPC_BEGIN_MESSAGE_MAP_EX(RenderViewHost, msg, msg_is_ok)
     IPC_MESSAGE_HANDLER(ViewHostMsg_ShowView, OnMsgShowView)
     IPC_MESSAGE_HANDLER(ViewHostMsg_ShowWidget, OnMsgShowWidget)
@@ skipping 661 matching lines @@
   if (view) {
     view->ShowPopupMenu(params.bounds,
                         params.item_height,
                         params.item_font_size,
                         params.selected_item,
                         params.popup_items,
                         params.right_aligned);
   }
 }
 #endif