Fix event page process cleanup when running in --isolate-extensions mode.

extensions/browser/process_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/process_manager.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/logging.h"
@@ skipping 551 matching lines @@
                  extension_id,
                  sequence_id),
       base::TimeDelta::FromMilliseconds(g_event_page_suspending_time_msec));
 }
 
 void ProcessManager::OnNetworkRequestStarted(
     content::RenderFrameHost* render_frame_host,
     uint64_t request_id) {
   ExtensionHost* host = GetBackgroundHostForExtension(
       GetExtensionID(render_frame_host));
-  auto result = pending_network_requests_.insert(request_id);
+  if (!host || !IsFrameInExtensionHost(host, render_frame_host))
+    return;
+
+  auto result =
+      pending_network_requests_.insert(std::make_pair(request_id, host));
   DCHECK(result.second) << "Duplicate network request IDs.";
-  if (host && IsFrameInExtensionHost(host, render_frame_host)) {
-    IncrementLazyKeepaliveCount(host->extension());
-    host->OnNetworkRequestStarted(request_id);
-  }
+
+  IncrementLazyKeepaliveCount(host->extension());
+  host->OnNetworkRequestStarted(request_id);
 }
 
 void ProcessManager::OnNetworkRequestDone(
     content::RenderFrameHost* render_frame_host,
     uint64_t request_id) {
-  ExtensionHost* host = GetBackgroundHostForExtension(
-      GetExtensionID(render_frame_host));
-  if (host && IsFrameInExtensionHost(host, render_frame_host)) {
-    host->OnNetworkRequestDone(request_id);
-    if (pending_network_requests_.erase(request_id))
-      DecrementLazyKeepaliveCount(host->extension());
-  }
+  auto result = pending_network_requests_.find(request_id);
+  if (result == pending_network_requests_.end())
+    return;
+
+  // The cached |host| can be invalid, if it was deleted between the time it
+  // was inserted in the map and the look up. It is checked to ensure it is in
+  // the list of existing background_hosts_.
+  ExtensionHost* host = result->second;
+  pending_network_requests_.erase(result);
+
+  if (background_hosts_.find(host) == background_hosts_.end())
+    return;
+
+  DCHECK(IsFrameInExtensionHost(host, render_frame_host));
+
+  host->OnNetworkRequestDone(request_id);
+  DecrementLazyKeepaliveCount(host->extension());
 }
 
 void ProcessManager::CancelSuspend(const Extension* extension) {
   bool& is_closing = background_page_data_[extension->id()].is_closing;
   ExtensionHost* host = GetBackgroundHostForExtension(extension->id());
   if (host && is_closing) {
     is_closing = false;
     host->render_process_host()->Send(
         new ExtensionMsg_CancelSuspend(extension->id()));
     // This increment / decrement is to simulate an instantaneous event. This
@@ skipping 377 matching lines @@
   if (extension && !IncognitoInfo::IsSplitMode(extension)) {
     BrowserContext* original_context =
         ExtensionsBrowserClient::Get()->GetOriginalContext(browser_context());
     return ProcessManager::Get(original_context)->GetSiteInstanceForURL(url);
   }
 
   return ProcessManager::GetSiteInstanceForURL(url);
 }
 
 }  // namespace extensions