Fix flaky IncognitoSplitMode. For real this time.

I accidentally checked in the wrong change last time.

This reverts r62432 and commits the code that was actually reviewed in http://codereview.chromium.org/3656005/show .

Stop processing incoming messages in BrowserRenderProcessHost when it is about
to be deleted. See comment 20 on the bug for details.

BUG=53991
TEST=handled by existing test

Review URL: http://codereview.chromium.org/3772003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@62445 0039d316-1c4b-4281-b951-d872f2087c98

5 files changed, 11 insertions, 19 deletions

diff --git a/chrome/browser/extensions/extension_incognito_apitest.cc b/chrome/browser/extensions/extension_incognito_apitest.cc
index 640fa14..23ddf8f 100644
--- a/chrome/browser/extensions/extension_incognito_apitest.cc
+++ b/chrome/browser/extensions/extension_incognito_apitest.cc
@@ -107,10 +107,7 @@ IN_PROC_BROWSER_TEST_F(ExtensionApiTest, Incognito) {
 
 // Tests that the APIs in an incognito-enabled split-mode extension work
 // properly.
-// TODO(mpcomplete): Crashes flakily. http://crbug.com/53991
-extern bool g_log_bug53991;
-IN_PROC_BROWSER_TEST_F(ExtensionApiTest, FLAKY_IncognitoSplitMode) {
-  g_log_bug53991 = true;
+IN_PROC_BROWSER_TEST_F(ExtensionApiTest, IncognitoSplitMode) {
   host_resolver()->AddRule("*", "127.0.0.1");
   ASSERT_TRUE(test_server()->Start());
 
diff --git a/chrome/browser/extensions/extension_message_service.cc b/chrome/browser/extensions/extension_message_service.cc
index db64037..7e675f5 100644
--- a/chrome/browser/extensions/extension_message_service.cc
+++ b/chrome/browser/extensions/extension_message_service.cc
@@ -161,12 +161,6 @@ void ExtensionMessageService::DestroyingProfile() {
 
 void ExtensionMessageService::AddEventListener(const std::string& event_name,
                                                int render_process_id) {
-  // It is possible that this RenderProcessHost is being destroyed. If that is
-  // the case, we'll have already removed his listeners, so do nothing here.
-  RenderProcessHost* rph = RenderProcessHost::FromID(render_process_id);
-  if (!rph || rph->ListenersIterator().IsAtEnd())
-    return;
-
   DCHECK_EQ(listeners_[event_name].count(render_process_id), 0u) << event_name;
   listeners_[event_name].insert(render_process_id);
 
@@ -178,11 +172,6 @@ void ExtensionMessageService::AddEventListener(const std::string& event_name,
 
 void ExtensionMessageService::RemoveEventListener(const std::string& event_name,
                                                   int render_process_id) {
-  // The RenderProcessHost may be destroyed. See AddEventListener.
-  RenderProcessHost* rph = RenderProcessHost::FromID(render_process_id);
-  if (!rph || rph->ListenersIterator().IsAtEnd())
-    return;
-
   DCHECK_EQ(listeners_[event_name].count(render_process_id), 1u)
       << " PID=" << render_process_id << " event=" << event_name;
   listeners_[event_name].erase(render_process_id);
diff --git a/chrome/browser/renderer_host/browser_render_process_host.cc b/chrome/browser/renderer_host/browser_render_process_host.cc
index 7b54d35..4c152e06 100644
--- a/chrome/browser/renderer_host/browser_render_process_host.cc
+++ b/chrome/browser/renderer_host/browser_render_process_host.cc
@@ -842,10 +842,11 @@ bool BrowserRenderProcessHost::Send(IPC::Message* msg) {
 }
 
 void BrowserRenderProcessHost::OnMessageReceived(const IPC::Message& msg) {
-  LOG_IF(INFO, g_log_bug53991) <<
-      "OnMessageReceived: " << this <<
-      "; type=" << msg.type() <<
-      "; routing=" << msg.routing_id();
+  // If we're about to be deleted, we can no longer trust that our profile is
+  // valid, so we ignore incoming messages.
+  if (deleting_soon_)
+    return;
+
   mark_child_process_activity_time();
   if (msg.routing_id() == MSG_ROUTING_CONTROL) {
     // Dispatch control messages.
diff --git a/chrome/browser/renderer_host/render_process_host.cc b/chrome/browser/renderer_host/render_process_host.cc
index 3bba7b5..b224b1f 100644
--- a/chrome/browser/renderer_host/render_process_host.cc
+++ b/chrome/browser/renderer_host/render_process_host.cc
@@ -92,6 +92,7 @@ void RenderProcessHost::SetMaxRendererProcessCount(size_t count) {
 RenderProcessHost::RenderProcessHost(Profile* profile)
     : max_page_id_(-1),
       fast_shutdown_started_(false),
+      deleting_soon_(false),
       id_(ChildProcessInfo::GenerateChildProcessUniqueId()),
       profile_(profile),
       sudden_termination_allowed_(true),
@@ -130,6 +131,7 @@ void RenderProcessHost::Release(int listener_id) {
         NotificationType::RENDERER_PROCESS_TERMINATED,
         Source<RenderProcessHost>(this), NotificationService::NoDetails());
     MessageLoop::current()->DeleteSoon(FROM_HERE, this);
+    deleting_soon_ = true;
 
     // Remove ourself from the list of renderer processes so that we can't be
     // reused in between now and when the Delete task runs.
diff --git a/chrome/browser/renderer_host/render_process_host.h b/chrome/browser/renderer_host/render_process_host.h
index 19911f0..a5fd378 100644
--- a/chrome/browser/renderer_host/render_process_host.h
+++ b/chrome/browser/renderer_host/render_process_host.h
@@ -277,6 +277,9 @@ class RenderProcessHost : public IPC::Channel::Sender,
   // True if fast shutdown has been performed on this RPH.
   bool fast_shutdown_started_;
 
+  // True if we've posted a DeleteTask and will be deleted soon.
+  bool deleting_soon_;
+
  private:
   // The globally-unique identifier for this RPH.
   int id_;