DevTools: browser CRASH upon listen socket disconnect in remote debugging.

BUG=59930

Review URL: http://codereview.chromium.org/5905004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@69413 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 17 insertions, 0 deletions

diff --git a/chrome/browser/debugger/devtools_http_protocol_handler.cc b/chrome/browser/debugger/devtools_http_protocol_handler.cc
index e60045f..9f23945 100644
--- a/chrome/browser/debugger/devtools_http_protocol_handler.cc
+++ b/chrome/browser/debugger/devtools_http_protocol_handler.cc
@@ -270,6 +270,18 @@ void DevToolsHttpProtocolHandler::OnCloseUI(HttpListenSocket* socket) {
   client_host->NotifyCloseListener();
   delete client_host;
   socket_to_client_host_ui_.erase(socket);
+
+  // We are holding last reference to scoped refptr 'socket' here.
+  // We can't exit method just like that since 'socket' is going to
+  // be destroyed on the UI thread then. Schedule no-op to IO thread
+  // so that socket is destroyed on IO instead.
+  BrowserThread::PostTask(
+      BrowserThread::IO,
+      FROM_HERE,
+      NewRunnableMethod(
+          this,
+          &DevToolsHttpProtocolHandler::ReleaseSocket,
+          make_scoped_refptr(socket)));
 }
 
 void DevToolsHttpProtocolHandler::OnResponseStarted(net::URLRequest* request) {
@@ -404,6 +416,11 @@ void DevToolsHttpProtocolHandler::AcceptWebSocket(
                         request));
 }
 
+void DevToolsHttpProtocolHandler::ReleaseSocket(
+    HttpListenSocket* socket) {
+  // This in fact is scoped ref ptr. It'll get nuked on exit.
+}
+
 TabContents* DevToolsHttpProtocolHandler::GetTabContents(int session_id) {
   for (BrowserList::const_iterator it = BrowserList::begin(),
        end = BrowserList::end(); it != end; ++it) {