Remove the RenderProcessHost from the list of renderer processes when we call DeleteSoon, not in the destructor. Otherewise the process can be reused in the meantime. This matches what we do in ChildProcessHost.

BUG=21038
Review URL: http://codereview.chromium.org/257028

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@28034 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 7 insertions, 1 deletions

diff --git a/chrome/browser/renderer_host/render_process_host.cc b/chrome/browser/renderer_host/render_process_host.cc
index 0844192..6cefab0 100644
--- a/chrome/browser/renderer_host/render_process_host.cc
+++ b/chrome/browser/renderer_host/render_process_host.cc
@@ -88,7 +88,9 @@ RenderProcessHost::RenderProcessHost(Profile* profile)
 }
 
 RenderProcessHost::~RenderProcessHost() {
-  all_hosts.Remove(id());
+  // In unit tests, Release() might not have been called.
+  if (all_hosts.Lookup(id()))
+    all_hosts.Remove(id());
 }
 
 void RenderProcessHost::Attach(IPC::Channel::Listener* listener,
@@ -109,6 +111,10 @@ void RenderProcessHost::Release(int listener_id) {
         NotificationType::RENDERER_PROCESS_TERMINATED,
         Source<RenderProcessHost>(this), NotificationService::NoDetails());
     MessageLoop::current()->DeleteSoon(FROM_HERE, this);
+
+    // Remove ourself from the list of renderer processes so that we can't be
+    // reused in between now and when the Delete task runs.
+    all_hosts.Remove(id());
   }
 }