Reference count ProxyService....

chrome/browser/net/chrome_url_request_context.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/net/chrome_url_request_context.h"
 
 #include "base/command_line.h"
 #include "base/string_util.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/privacy_blacklist/blacklist.h"
@@ skipping 178 matching lines @@
   return context;
 }
 
 // static
 ChromeURLRequestContext* ChromeURLRequestContext::CreateOffTheRecord(
     Profile* profile) {
   DCHECK(profile->IsOffTheRecord());
   ChromeURLRequestContext* context = new ChromeURLRequestContext(profile);
 
   // Share the same proxy service and host resolver as the original profile.
-  // This proxy service's lifespan is dependent on the lifespan of the original
-  // profile which we reference (see above).
+  // TODO(eroman): although ProxyService is reference counted, this sharing
+  // still has a subtle dependency on the lifespan of the original profile --
+  // ProxyService holds a (non referencing) pointer to the URLRequestContext
+  // it uses to download PAC scripts, which in this case is the original
+  // profile...
   context->host_resolver_ =
       profile->GetOriginalProfile()->GetRequestContext()->host_resolver();
   context->proxy_service_ =
       profile->GetOriginalProfile()->GetRequestContext()->proxy_service();
 
   context->http_transaction_factory_ =
       new net::HttpCache(context->host_resolver_, context->proxy_service_, 0);
   context->cookie_store_ = new net::CookieMonster;
 
   // The kNewFtp switch is Windows specific because we have multiple FTP
@@ skipping 295 matching lines @@
   NotificationService::current()->Notify(
       NotificationType::URL_REQUEST_CONTEXT_RELEASED,
       Source<URLRequestContext>(this),
       NotificationService::NoDetails());
 
   delete ftp_transaction_factory_;
   delete http_transaction_factory_;
 
   // Do not delete the cookie store in the case of the media context, as it is
   // owned by the original context.
+  // TODO(eroman): The lifetime expectation of cookie_store_ is not right.
+  // The assumption here is that the original request context (which owns
+  // cookie_store_) is going to outlive the media context (which uses it).
+  // However based on the destruction order of profiles this is not true.
+  // http://crbug.com/15289.
   if (!is_media_)
     delete cookie_store_;
-
-  // Do not delete the proxy service in the case of OTR or media contexts, as
-  // it is owned by the original URLRequestContext.
-  if (!is_off_the_record_ && !is_media_)
-    delete proxy_service_;
 }