Fix a race in BrowserRenderProcessHost::FastShutdownIfPossible

content/browser/renderer_host/browser_render_process_host.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Represents the browser side of the browser <--> renderer communication
 // channel. There will be one RenderProcessHost per renderer process.
 
 #include "content/browser/renderer_host/browser_render_process_host.h"
 
 #include <algorithm>
@@ skipping 635 matching lines @@
 
   // Test if there's an unload listener.
   // NOTE: It's possible that an onunload listener may be installed
   // while we're shutting down, so there's a small race here.  Given that
   // the window is small, it's unlikely that the web page has much
   // state that will be lost by not calling its unload handlers properly.
   if (!sudden_termination_allowed())
     return false;
 
   child_process_launcher_.reset();
+  ProcessDied();
   fast_shutdown_started_ = true;
   return true;
 }
 
 // This is a platform specific function for mapping a transport DIB given its id
 TransportDIB* BrowserRenderProcessHost::MapTransportDIB(
     TransportDIB::Id dib_id) {
 #if defined(OS_WIN)
   // On Windows we need to duplicate the handle from the remote process
   HANDLE section = chrome::GetSectionFromProcess(
@@ skipping 129 matching lines @@
   Send(new ChildProcessMsg_SetIPCLoggingEnabled(
       IPC::Logging::GetInstance()->Enabled()));
 #endif
 
   // Make sure the child checks with us before exiting, so that we do not try
   // to schedule a new navigation in a swapped out and exiting renderer.
   Send(new ChildProcessMsg_AskBeforeShutdown());
 }
 
 void BrowserRenderProcessHost::OnChannelError() {
+  ProcessDied();
+}
+
+void BrowserRenderProcessHost::ProcessDied() {
   // Our child process has died.  If we didn't expect it, it's a crash.
   // In any case, we need to let everyone know it's gone.
   // The OnChannelError notification can fire multiple times due to nested sync
   // calls to a renderer. If we don't have a valid channel here it means we
   // already handled the error.
   if (!channel_.get())
     return;
 
   // child_process_launcher_ can be NULL in single process mode or if fast
   // termination happened.
@@ skipping 122 matching lines @@
 void BrowserRenderProcessHost::OnRevealFolderInOS(const FilePath& path) {
   // Only honor the request if appropriate persmissions are granted.
   if (ChildProcessSecurityPolicy::GetInstance()->CanReadFile(id(), path))
     content::GetContentClient()->browser()->OpenItem(path);
 }
 
 void BrowserRenderProcessHost::OnSavedPageAsMHTML(int job_id, bool success) {
   content::GetContentClient()->browser()->GetMHTMLGenerationManager()->
       MHTMLGenerated(job_id, success);
 }