Make WebContentsImpl aware of all of its RWHs.

content/browser/web_contents/web_contents_impl.cc

Index: content/browser/web_contents/web_contents_impl.cc
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 4b2385f9903b1d4795b18ca0374260c03a8830bd..dd0f148bc910dc8641047ddad8c2bd98597b6dbf 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -1497,17 +1497,17 @@ void WebContentsImpl::LostCapture(RenderWidgetHostImpl* render_widget_host) {
     delegate_->LostCapture();
 }
 
+void WebContentsImpl::RenderWidgetCreated(
+    RenderWidgetHostImpl* render_widget_host) {
+  created_widgets_.insert(render_widget_host);
+}
+
 void WebContentsImpl::RenderWidgetDeleted(
     RenderWidgetHostImpl* render_widget_host) {
-  if (is_being_destroyed_) {
-    // |created_widgets_| might have been destroyed.
-    return;
-  }
+  created_widgets_.erase(render_widget_host);

[Charlie Reis, 2015/11/21 01:19:19]

How are you getting here after is_being_destroyed_ is set to true but before
created_widgets_ is cleared?  Is one of the lines in the WebContentsImpl
destructor triggering this?

Maybe add a comment how it's possible, as a breadcrumb to future developers.

[lazyboy, 2015/11/21 02:22:59]

Yes.
FrameTree::ForEach in ~WebContentsImpl() calls RFHM::ClearRHFsPendingShutdown()
From:
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...
See this shortened callstack:
    #2 0x32f6377 in content::RenderWidgetHostImpl::Shutdown()
content/browser/renderer_host/render_widget_host_impl.cc:438
    #3 0x32e5d7e in content::RenderViewHostImpl::Shutdown()
content/browser/renderer_host/render_view_host_impl.cc:978:3
    #4 0x2e4615f in
content::FrameTree::ReleaseRenderViewHostRef(content::RenderViewHostImpl*)
content/browser/frame_host/frame_tree.cc:359:7
    #5 0x2e92199 in content::RenderFrameHostImpl::~RenderFrameHostImpl()
content/browser/frame_host/render_frame_host_impl.cc:271:3
...
    #14 0x2ebe798 in
content::RenderFrameHostManager::ClearRFHsPendingShutdown(content::FrameTreeNode*)
content/browser/frame_host/render_frame_host_manager.cc:206
    #15 0x2e4290a in Run base/callback.h:396:12
    #16 0x2e4290a in content::FrameTree::ForEach(base::Callback<bool
(content::FrameTreeNode*)> const&, content::FrameTreeNode*) const
content/browser/frame_host/frame_tree.cc:189
    #17 0x35a6ca6 in content::WebContentsImpl::~WebContentsImpl()
content/browser/web_contents/web_contents_impl.cc:424:3
Done.

 
-  std::set<RenderWidgetHostImpl*>::iterator iter =
-      created_widgets_.find(render_widget_host);
-  if (iter != created_widgets_.end())
-    created_widgets_.erase(iter);
+  if (is_being_destroyed_)
+    return;
 
   if (render_widget_host &&
       render_widget_host->GetRoutingID() == fullscreen_widget_routing_id_) {
@@ -1917,7 +1917,6 @@ void WebContentsImpl::CreateNewWidget(int32 render_process_id,
 
   RenderWidgetHostImpl* widget_host =
       new RenderWidgetHostImpl(this, process, route_id, IsHidden());
-  created_widgets_.insert(widget_host);
 
   RenderWidgetHostViewBase* widget_view =
       static_cast<RenderWidgetHostViewBase*>(