Fix a crash where the ResourceMessageFilter is deleted

chrome/browser/extensions/extension_message_service.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_message_service.h"
 
 #include "base/singleton.h"
 #include "chrome/browser/chrome_thread.h"
 #include "chrome/browser/extensions/extension.h"
 #include "chrome/browser/extensions/extension_view.h"
 #include "chrome/browser/renderer_host/render_view_host.h"
 #include "chrome/browser/renderer_host/render_process_host.h"
 #include "chrome/browser/renderer_host/resource_message_filter.h"
+#include "chrome/common/notification_service.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/stl_util-inl.h"
 
 // Since we have 2 ports for every channel, we just index channels by half the
 // port ID.
 #define GET_CHANNEL_ID(port_id) ((port_id) / 2)
 
 // Port1 is always even, port2 is always odd.
 #define IS_PORT1_ID(port_id) (((port_id) & 1) == 0)
 
@@ skipping 101 matching lines @@
   }
 
   int source_port_id = GET_OPPOSITE_PORT_ID(port_id);
   dest->Send(new ViewMsg_ExtensionHandleMessage(message, source_port_id));
 }
 
 void ExtensionMessageService::RendererReady(ResourceMessageFilter* renderer) {
   AutoLock lock(renderers_lock_);
   DCHECK(renderers_.find(renderer->GetProcessId()) == renderers_.end());
   renderers_[renderer->GetProcessId()] = renderer;
+
+  NotificationService::current()->AddObserver(

[Matt Perry, 2009/04/17 23:31:02]

This doesn't work.  RendererReady is called on the UI thread, but the
notification is sent on the IO thread.

+      this,
+      NotificationType::RESOURCE_MESSAGE_FILTER_SHUTDOWN,
+      Source<ResourceMessageFilter>(renderer));
 }
 
-void ExtensionMessageService::RendererShutdown(
-    ResourceMessageFilter* renderer) {
+void ExtensionMessageService::Observe(NotificationType type,
+                                      const NotificationSource& source,
+                                      const NotificationDetails& details) {
+  DCHECK(type.value == NotificationType::RESOURCE_MESSAGE_FILTER_SHUTDOWN);
+  ResourceMessageFilter* filter = Source<ResourceMessageFilter>(source).ptr();
+
   {
     AutoLock lock(renderers_lock_);
-    DCHECK(renderers_.find(renderer->GetProcessId()) != renderers_.end());
-    renderers_.erase(renderer->GetProcessId());
+    DCHECK(renderers_.find(filter->GetProcessId()) != renderers_.end());
+    renderers_.erase(filter->GetProcessId());
   }
 
   // Close any channels that share this filter.
   // TODO(mpcomplete): should we notify the other side of the port?
   for (MessageChannelMap::iterator it = channels_.begin();
        it != channels_.end(); ) {
     MessageChannelMap::iterator current = it++;
-    if (current->second.port1 == renderer || current->second.port2 == renderer)
+    if (current->second.port1 == filter || current->second.port2 == filter)
       channels_.erase(current);
   }
+
+  NotificationService::current()->RemoveObserver(
+      this,
+      NotificationType::RESOURCE_MESSAGE_FILTER_SHUTDOWN,
+      Source<ResourceMessageFilter>(filter));
 }
+