Fix use-after-free. OnChildDied deletes the current object, so we shouldn't call member functions...

content/browser/browser_child_process_host.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/browser_child_process_host.h"
 
 #include "base/command_line.h"
 #include "base/file_path.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
@@ skipping 210 matching lines @@
 // The child process handle has been signaled so the exit code is finally
 // available. Unfortunately STILL_ACTIVE (0x103) is a valid exit code in
 // which case we should not call OnChildDisconnected() or else we will be
 // waiting forever.
 void BrowserChildProcessHost::OnWaitableEventSignaled(
     base::WaitableEvent* waitable_event) {
 #if defined (OS_WIN)
   unsigned long exit_code = 0;
   GetExitCodeProcess(waitable_event->Release(), &exit_code);
   delete waitable_event;
-  if (exit_code == STILL_ACTIVE)
+  if (exit_code == STILL_ACTIVE) {
     OnChildDied();
-  BrowserChildProcessHost::OnChildDisconnected();
+  } else {
+    BrowserChildProcessHost::OnChildDisconnected();
+  }
 #endif
 }
 
 void BrowserChildProcessHost::ShutdownStarted() {
   // Must remove the process from the list now, in case it gets used for a
   // new instance before our watcher tells us that the process terminated.
   g_child_process_list.Get().remove(this);
 }
 
 BrowserChildProcessHost::ClientHook::ClientHook(BrowserChildProcessHost* host)
@@ skipping 36 matching lines @@
 
     return *iterator_;
   } while (true);
 
   return NULL;
 }
 
 bool BrowserChildProcessHost::Iterator::Done() {
   return iterator_ == g_child_process_list.Get().end();
 }