Fix WebSocket crash bug.

When closing the tab, ResourceDispatcherHost::Receiver is deleted, so
all SocketStreamHost for the receiver should be deleted.
Add CancelRequestsForProcess() in SocketStreamDispatcherHost that deletes
all SocketStreamHost for the |host_id|.

BUG=30290
TEST=visit http://wbe02.mibbit.com/?debug=true&channel=%23websocket, and close the tab. Didn't crash the browser.

Review URL: http://codereview.chromium.org/494011

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@34456 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 20 insertions, 12 deletions

diff --git a/chrome/browser/renderer_host/resource_dispatcher_host.cc b/chrome/browser/renderer_host/resource_dispatcher_host.cc
index ad999cb..657e495 100644
--- a/chrome/browser/renderer_host/resource_dispatcher_host.cc
+++ b/chrome/browser/renderer_host/resource_dispatcher_host.cc
@@ -920,6 +920,7 @@ int ResourceDispatcherHost::GetOutstandingRequestsMemoryCost(
 // for downloads, which belong to the browser process even if initiated via a
 // renderer.
 void ResourceDispatcherHost::CancelRequestsForProcess(int child_id) {
+  socket_stream_dispatcher_host_->CancelRequestsForProcess(child_id);
   CancelRequestsForRoute(child_id, -1 /* cancel all */);
 }
 
diff --git a/chrome/browser/renderer_host/socket_stream_dispatcher_host.cc b/chrome/browser/renderer_host/socket_stream_dispatcher_host.cc
index a993683..8cff36c 100644
--- a/chrome/browser/renderer_host/socket_stream_dispatcher_host.cc
+++ b/chrome/browser/renderer_host/socket_stream_dispatcher_host.cc
@@ -21,18 +21,7 @@ SocketStreamDispatcherHost::~SocketStreamDispatcherHost() {
        !iter.IsAtEnd();
        iter.Advance()) {
     int host_id = iter.GetCurrentKey();
-    IDMap<SocketStreamHost>* hosts =
-        const_cast<IDMap<SocketStreamHost> *>(iter.GetCurrentValue());
-    for (IDMap<SocketStreamHost>::const_iterator hosts_iter(hosts);
-         !hosts_iter.IsAtEnd();
-         hosts_iter.Advance()) {
-      int socket_id = iter.GetCurrentKey();
-      const SocketStreamHost* socket_stream_host = hosts_iter.GetCurrentValue();
-      delete socket_stream_host;
-      hosts->Remove(socket_id);
-    }
-    hostmap_.Remove(host_id);
-    delete hosts;
+    CancelRequestsForProcess(host_id);
   }
 }
 
@@ -56,6 +45,22 @@ bool SocketStreamDispatcherHost::OnMessageReceived(
   return handled;
 }
 
+void SocketStreamDispatcherHost::CancelRequestsForProcess(int host_id) {
+  IDMap<SocketStreamHost>* hosts = hostmap_.Lookup(host_id);
+  if (hosts == NULL)
+    return;
+  for (IDMap<SocketStreamHost>::const_iterator hosts_iter(hosts);
+       !hosts_iter.IsAtEnd();
+       hosts_iter.Advance()) {
+    const SocketStreamHost* socket_stream_host = hosts_iter.GetCurrentValue();
+    delete socket_stream_host;
+    int socket_id = hosts_iter.GetCurrentKey();
+    hosts->Remove(socket_id);
+  }
+  hostmap_.Remove(host_id);
+  delete hosts;
+}
+
 // SocketStream::Delegate methods implementations.
 void SocketStreamDispatcherHost::OnConnected(net::SocketStream* socket,
                                              int max_pending_send_allowed) {
diff --git a/chrome/browser/renderer_host/socket_stream_dispatcher_host.h b/chrome/browser/renderer_host/socket_stream_dispatcher_host.h
index 01297ff..2fd8109 100644
--- a/chrome/browser/renderer_host/socket_stream_dispatcher_host.h
+++ b/chrome/browser/renderer_host/socket_stream_dispatcher_host.h
@@ -26,6 +26,8 @@ class SocketStreamDispatcherHost : public net::SocketStream::Delegate {
   bool OnMessageReceived(const IPC::Message& msg,
                          ResourceDispatcherHost::Receiver* receiver,
                          bool* msg_ok);
+  // The object died, so cancel and detach all requests associated with it.
+  void CancelRequestsForProcess(int host_id);
 
   // SocketStream::Delegate methods.
   virtual void OnConnected(net::SocketStream* socket,