Detect and clean up discarded mojo connections to deleted RenderFrames.

content/renderer/render_thread_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_thread_impl.h"
 
 #include <algorithm>
 #include <limits>
 #include <map>
 #include <vector>
@@ skipping 856 matching lines @@
       pending_render_frame_connects_.find(routing_id);
   if (it == pending_render_frame_connects_.end())
     return;
 
   RenderFrameImpl* frame = RenderFrameImpl::FromRoutingID(routing_id);
   if (!frame)
     return;
 
   scoped_refptr<PendingRenderFrameConnect> connection(it->second);
   mojo::InterfaceRequest<mojo::ServiceProvider> services(
-      connection->services.Pass());
+      connection->services().Pass());
   mojo::ServiceProviderPtr exposed_services(
-      connection->exposed_services.Pass());
+      connection->exposed_services().Pass());
+  exposed_services.set_error_handler(nullptr);
   pending_render_frame_connects_.erase(it);
 
   frame->BindServiceRegistry(services.Pass(), exposed_services.Pass());
 }
 
 void RenderThreadImpl::RemoveRoute(int32 routing_id) {
   ChildThreadImpl::GetRouter()->RemoveRoute(routing_id);
 }
 
 void RenderThreadImpl::AddEmbeddedWorkerRoute(int32 routing_id,
@@ skipping 14 matching lines @@
 }
 
 void RenderThreadImpl::RegisterPendingRenderFrameConnect(
     int routing_id,
     mojo::InterfaceRequest<mojo::ServiceProvider> services,
     mojo::ServiceProviderPtr exposed_services) {
   std::pair<PendingRenderFrameConnectMap::iterator, bool> result =
       pending_render_frame_connects_.insert(std::make_pair(
           routing_id,
           make_scoped_refptr(new PendingRenderFrameConnect(
-              services.Pass(),
-              exposed_services.Pass()))));
+              routing_id, services.Pass(), exposed_services.Pass()))));
   CHECK(result.second) << "Inserting a duplicate item.";
 }
 
 int RenderThreadImpl::GenerateRoutingID() {
   int routing_id = MSG_ROUTING_NONE;
   Send(new ViewHostMsg_GenerateRoutingID(&routing_id));
   return routing_id;
 }
 
 void RenderThreadImpl::AddFilter(IPC::MessageFilter* filter) {
@@ skipping 857 matching lines @@
   hidden_widget_count_--;
 
   if (!GetContentClient()->renderer()->RunIdleHandlerWhenWidgetsHidden()) {
     return;
   }
 
   ScheduleIdleHandler(kLongIdleHandlerDelayMs);
 }
 
 RenderThreadImpl::PendingRenderFrameConnect::PendingRenderFrameConnect(
+    int routing_id,
     mojo::InterfaceRequest<mojo::ServiceProvider> services,
     mojo::ServiceProviderPtr exposed_services)
-    : services(services.Pass()),
-      exposed_services(exposed_services.Pass()) {
+    : routing_id_(routing_id),
+      services_(services.Pass()),
+      exposed_services_(exposed_services.Pass()) {
+  // The RenderFrame may be deleted before the ExchangeServiceProviders message
+  // is received. In that case, the RenderFrameHost should close the connection,
+  // which is detected by setting an error handler on |exposed_services_|.
+  exposed_services_.set_error_handler(this);
 }
 
 RenderThreadImpl::PendingRenderFrameConnect::~PendingRenderFrameConnect() {
 }
 
+void RenderThreadImpl::PendingRenderFrameConnect::OnConnectionError() {
+  size_t erased =
+      RenderThreadImpl::current()->pending_render_frame_connects_.erase(
+          routing_id_);
+  DCHECK_EQ(1u, erased);
+}
+
 }  // namespace content