Make WebContentsImpl aware of all of its RWHs.

content/browser/web_contents/web_contents_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_impl.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/lazy_instance.h"
@@ skipping 1479 matching lines @@
 }
 
 void WebContentsImpl::LostCapture(RenderWidgetHostImpl* render_widget_host) {
   if (!RenderViewHostImpl::From(render_widget_host))
     return;
 
   if (delegate_)
     delegate_->LostCapture();
 }
 
+void WebContentsImpl::RenderWidgetCreated(
+    RenderWidgetHostImpl* render_widget_host) {
+  created_widgets_.insert(render_widget_host);
+}
+
 void WebContentsImpl::RenderWidgetDeleted(
     RenderWidgetHostImpl* render_widget_host) {
-  if (is_being_destroyed_) {
-    // |created_widgets_| might have been destroyed.
+  created_widgets_.erase(render_widget_host);

[Charlie Reis, 2015/11/21 01:19:19]

How are you getting here after is_being_destroyed_ is set to true but before
created_widgets_ is cleared?  Is one of the lines in the WebContentsImpl
destructor triggering this?

Maybe add a comment how it's possible, as a breadcrumb to future developers.

[lazyboy, 2015/11/21 02:22:59]

Yes.
FrameTree::ForEach in ~WebContentsImpl() calls RFHM::ClearRHFsPendingShutdown()
From:
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...
See this shortened callstack:
    #2 0x32f6377 in content::RenderWidgetHostImpl::Shutdown()
content/browser/renderer_host/render_widget_host_impl.cc:438
    #3 0x32e5d7e in content::RenderViewHostImpl::Shutdown()
content/browser/renderer_host/render_view_host_impl.cc:978:3
    #4 0x2e4615f in
content::FrameTree::ReleaseRenderViewHostRef(content::RenderViewHostImpl*)
content/browser/frame_host/frame_tree.cc:359:7
    #5 0x2e92199 in content::RenderFrameHostImpl::~RenderFrameHostImpl()
content/browser/frame_host/render_frame_host_impl.cc:271:3
...
    #14 0x2ebe798 in
content::RenderFrameHostManager::ClearRFHsPendingShutdown(content::FrameTreeNode*)
content/browser/frame_host/render_frame_host_manager.cc:206
    #15 0x2e4290a in Run base/callback.h:396:12
    #16 0x2e4290a in content::FrameTree::ForEach(base::Callback<bool
(content::FrameTreeNode*)> const&, content::FrameTreeNode*) const
content/browser/frame_host/frame_tree.cc:189
    #17 0x35a6ca6 in content::WebContentsImpl::~WebContentsImpl()
content/browser/web_contents/web_contents_impl.cc:424:3
Done.

+
+  if (is_being_destroyed_)
     return;
-  }
-
-  std::set<RenderWidgetHostImpl*>::iterator iter =
-      created_widgets_.find(render_widget_host);
-  if (iter != created_widgets_.end())
-    created_widgets_.erase(iter);
 
   if (render_widget_host &&
       render_widget_host->GetRoutingID() == fullscreen_widget_routing_id_) {
     if (delegate_ && delegate_->EmbedsFullscreenWidget())
       delegate_->ExitFullscreenModeForTab(this);
     FOR_EACH_OBSERVER(WebContentsObserver,
                       observers_,
                       DidDestroyFullscreenWidget(
                           fullscreen_widget_routing_id_));
     fullscreen_widget_routing_id_ = MSG_ROUTING_NONE;
@@ skipping 389 matching lines @@
     if (process_handle != base::kNullProcessHandle) {
       RecordAction(
           base::UserMetricsAction("Terminate_ProcessMismatch_CreateNewWidget"));
       rph->Shutdown(RESULT_CODE_KILLED, false);
     }
     return;
   }
 
   RenderWidgetHostImpl* widget_host =
       new RenderWidgetHostImpl(this, process, route_id, IsHidden());
-  created_widgets_.insert(widget_host);
 
   RenderWidgetHostViewBase* widget_view =
       static_cast<RenderWidgetHostViewBase*>(
           view_->CreateViewForPopupWidget(widget_host));
   if (!widget_view)
     return;
   if (!is_fullscreen) {
     // Popups should not get activated.
     widget_view->SetPopupType(popup_type);
   }
@@ skipping 2852 matching lines @@
   return NULL;
 }
 
 void WebContentsImpl::SetForceDisableOverscrollContent(bool force_disable) {
   force_disable_overscroll_content_ = force_disable;
   if (view_)
     view_->SetOverscrollControllerEnabled(CanOverscrollContent());
 }
 
 }  // namespace content