Fix another race condition on worker process shutdown that results in use-aft...

webkit/glue/webworker_impl.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 
 #include "base/compiler_specific.h"
 
 #include "DedicatedWorkerContext.h"
 #include "DedicatedWorkerThread.h"
@@ skipping 200 matching lines @@
 }
 
 void WebWorkerImpl::workerObjectDestroyed() {
   // Worker object in the renderer was destroyed, perhaps a result of GC.
   // For us, it's a signal to start terminating the WorkerContext too.
   // TODO(dimich): when 'kill a worker' html5 spec algorithm is implemented, it
   // should be used here instead of 'terminate a worker'.
   terminateWorkerContext();
 }
 
+void WebWorkerImpl::clientDestroyed() {
+  client_ = NULL;
+}
+
 void WebWorkerImpl::DispatchTaskToMainThread(
     PassRefPtr<WebCore::ScriptExecutionContext::Task> task) {
   return WTF::callOnMainThread(InvokeTaskMethod, task.releaseRef());
 }
 
 void WebWorkerImpl::InvokeTaskMethod(void* param) {
   WebCore::ScriptExecutionContext::Task* task =
       static_cast<WebCore::ScriptExecutionContext::Task*>(param);
   task->performTask(NULL);
   task->deref();
 }
 
 // WorkerObjectProxy -----------------------------------------------------------
 
 void WebWorkerImpl::postMessageToWorkerObject(
     WTF::PassRefPtr<WebCore::SerializedScriptValue> message,
     WTF::PassOwnPtr<WebCore::MessagePortChannelArray> channels) {
   DispatchTaskToMainThread(WebCore::createCallbackTask(
       &PostMessageTask,
       this,
       message->toString(),
       channels));
 }
 
 void WebWorkerImpl::PostMessageTask(
     WebCore::ScriptExecutionContext* context,
     WebWorkerImpl* this_ptr,
     WebCore::String message,
     WTF::PassOwnPtr<WebCore::MessagePortChannelArray> channels) {
+  if (!this_ptr->client_)
+    return;
+
   WebMessagePortChannelArray web_channels(
       channels.get() ? channels->size() : 0);
   for (size_t i = 0; i < web_channels.size(); ++i) {
     web_channels[i] = (*channels)[i]->channel()->webChannelRelease();
     web_channels[i]->setClient(0);
   }
 
   this_ptr->client_->postMessageToWorkerObject(
       webkit_glue::StringToWebString(message), web_channels);
 }
 
 void WebWorkerImpl::postExceptionToWorkerObject(
     const WebCore::String& error_message,
     int line_number,
     const WebCore::String& source_url) {
   DispatchTaskToMainThread(WebCore::createCallbackTask(
       &PostExceptionTask,
       this,
       error_message,
       line_number,
       source_url));
 }
 
 void WebWorkerImpl::PostExceptionTask(
       WebCore::ScriptExecutionContext* context,
       WebWorkerImpl* this_ptr,
       const WebCore::String& error_message,
       int line_number,
       const WebCore::String& source_url) {
+  if (!this_ptr->client_)
+    return;
+
   this_ptr->client_->postExceptionToWorkerObject(
       webkit_glue::StringToWebString(error_message),
       line_number,
       webkit_glue::StringToWebString(source_url));
 }
 
 void WebWorkerImpl::postConsoleMessageToWorkerObject(
     WebCore::MessageDestination destination,
     WebCore::MessageSource source,
     WebCore::MessageType type,
@@ skipping 16 matching lines @@
 void WebWorkerImpl::PostConsoleMessageTask(
     WebCore::ScriptExecutionContext* context,
     WebWorkerImpl* this_ptr,
     int destination,
     int source,
     int type,
     int level,
     const WebCore::String& message,
     int line_number,
     const WebCore::String& source_url) {
+  if (!this_ptr->client_)
+    return;
+
   this_ptr->client_->postConsoleMessageToWorkerObject(
       destination,
       source,
       type,
       level,
       webkit_glue::StringToWebString(message),
       line_number,
       webkit_glue::StringToWebString(source_url));
 }
 
 void WebWorkerImpl::confirmMessageFromWorkerObject(bool has_pending_activity) {
   DispatchTaskToMainThread(WebCore::createCallbackTask(
       &ConfirmMessageTask,
       this,
       has_pending_activity));
 }
 
 void WebWorkerImpl::ConfirmMessageTask(
     WebCore::ScriptExecutionContext* context,
     WebWorkerImpl* this_ptr,
     bool has_pending_activity) {
+  if (!this_ptr->client_)
+    return;
+
   this_ptr->client_->confirmMessageFromWorkerObject(has_pending_activity);
 }
 
 void WebWorkerImpl::reportPendingActivity(bool has_pending_activity) {
   DispatchTaskToMainThread(WebCore::createCallbackTask(
       &ReportPendingActivityTask,
       this,
       has_pending_activity));
 }
 
 void WebWorkerImpl::ReportPendingActivityTask(
     WebCore::ScriptExecutionContext* context,
     WebWorkerImpl* this_ptr,
     bool has_pending_activity) {
+  if (!this_ptr->client_)
+    return;
+
   this_ptr->client_->reportPendingActivity(has_pending_activity);
 }
 
 void WebWorkerImpl::workerContextDestroyed() {
   DispatchTaskToMainThread(WebCore::createCallbackTask(
       &WorkerContextDestroyedTask,
       this));
 }
 
 // WorkerLoaderProxy -----------------------------------------------------------
 
 void WebWorkerImpl::postTaskToLoader(
     PassRefPtr<WebCore::ScriptExecutionContext::Task> task) {
   ASSERT(loading_document_->isDocument());
   loading_document_->postTask(task);
 }
 
 void WebWorkerImpl::postTaskForModeToWorkerContext(
     PassRefPtr<WebCore::ScriptExecutionContext::Task> task,
     const WebCore::String& mode) {
   worker_thread_->runLoop().postTaskForMode(task, mode);
 }
 
 void WebWorkerImpl::WorkerContextDestroyedTask(
     WebCore::ScriptExecutionContext* context,
     WebWorkerImpl* this_ptr) {
-  this_ptr->client_->workerContextDestroyed();
+  if (this_ptr->client_)
+    this_ptr->client_->workerContextDestroyed();
 
   // The lifetime of this proxy is controlled by the worker context.
   delete this_ptr;
 }
 
 #else
 
 namespace WebKit {
 
 WebWorker* WebWorker::create(WebWorkerClient* client) {
   return NULL;
 }
 
 }
 
 #endif