Adds some debugging code in hopes of isolating bug 6316. I suspect the

RVH is getting deleted some how and the RVHM isn't cleanly up
correctly.

BUG=6316
TEST=none

Review URL: http://codereview.chromium.org/20185

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@9457 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 34 insertions, 3 deletions

diff --git a/chrome/browser/renderer_host/render_view_host.cc b/chrome/browser/renderer_host/render_view_host.cc
index a84b582..302ccc3 100644
--- a/chrome/browser/renderer_host/render_view_host.cc
+++ b/chrome/browser/renderer_host/render_view_host.cc
@@ -25,6 +25,8 @@
 #include "chrome/browser/tab_contents/web_contents.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/resource_bundle.h"
+#include "chrome/common/notification_service.h"
+#include "chrome/common/notification_type.h"
 #include "chrome/common/thumbnail_score.h"
 #include "net/base/net_util.h"
 #include "skia/include/SkBitmap.h"
@@ -121,6 +123,11 @@ RenderViewHost::~RenderViewHost() {
   // Be sure to clean up any leftover state from cross-site requests.
   Singleton<CrossSiteRequestManager>()->SetHasPendingCrossSiteRequest(
       process()->host_id(), routing_id(), false);
+
+  NotificationService::current()->Notify(
+      NotificationType::RENDER_VIEW_HOST_DELETED,
+      Source<RenderViewHost>(this),
+      NotificationService::NoDetails());
 }
 
 bool RenderViewHost::CreateRenderView() {
diff --git a/chrome/browser/tab_contents/render_view_host_manager.cc b/chrome/browser/tab_contents/render_view_host_manager.cc
index c512b9a..d315eac 100644
--- a/chrome/browser/tab_contents/render_view_host_manager.cc
+++ b/chrome/browser/tab_contents/render_view_host_manager.cc
@@ -14,6 +14,7 @@
 #include "chrome/browser/tab_contents/site_instance.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/notification_service.h"
+#include "chrome/common/notification_type.h"
 
 namespace base {
 class WaitableEvent;
@@ -30,6 +31,8 @@ RenderViewHostManager::RenderViewHostManager(
       render_view_host_(NULL),
       pending_render_view_host_(NULL),
       interstitial_page_(NULL) {
+  registrar_.Add(this, NotificationType::RENDER_VIEW_HOST_DELETED,
+                 NotificationService::AllSources());
 }
 
 RenderViewHostManager::~RenderViewHostManager() {
@@ -56,8 +59,9 @@ void RenderViewHostManager::Shutdown() {
     CancelPendingRenderView();
 
   // We should always have a main RenderViewHost.
-  render_view_host_->Shutdown();
+  RenderViewHost* render_view_host = render_view_host_;
   render_view_host_ = NULL;
+  render_view_host->Shutdown();
 }
 
 RenderViewHost* RenderViewHostManager::Navigate(const NavigationEntry& entry) {
@@ -245,6 +249,17 @@ void RenderViewHostManager::OnJavaScriptMessageBoxClosed(
   render_view_host_->JavaScriptMessageBoxClosed(reply_msg, success, prompt);
 }
 
+void RenderViewHostManager::Observe(NotificationType type,
+                                    const NotificationSource& source,
+                                    const NotificationDetails& details) {
+  // Debugging code to help isolate
+  // http://code.google.com/p/chromium/issues/detail?id=6316 . We should never
+  // reference a RVH that is about to be deleted.
+  RenderViewHost* deleted_rvh = Source<RenderViewHost>(source).ptr();
+  CHECK(deleted_rvh);
+  CHECK(render_view_host_ != deleted_rvh);
+  CHECK(pending_render_view_host_ != deleted_rvh);
+}
 
 bool RenderViewHostManager::ShouldTransitionCrossSite() {
   // True if we are using process-per-site-instance (default) or
@@ -508,8 +523,9 @@ RenderViewHost* RenderViewHostManager::UpdateRendererStateNavigate(
 }
 
 void RenderViewHostManager::CancelPendingRenderView() {
-  pending_render_view_host_->Shutdown();
+  RenderViewHost* pending_render_view_host = pending_render_view_host_;
   pending_render_view_host_ = NULL;
+  pending_render_view_host->Shutdown();
 }
 
 void RenderViewHostManager::CrossSiteNavigationCanceled() {
diff --git a/chrome/browser/tab_contents/render_view_host_manager.h b/chrome/browser/tab_contents/render_view_host_manager.h
index 3522b40..268b298 100644
--- a/chrome/browser/tab_contents/render_view_host_manager.h
+++ b/chrome/browser/tab_contents/render_view_host_manager.h
@@ -7,6 +7,8 @@
 
 #include "base/basictypes.h"
 #include "chrome/browser/renderer_host/render_view_host.h"
+#include "chrome/common/notification_registrar.h"
+#include "chrome/common/notification_observer.h"
 
 class InterstitialPage;
 class NavigationController;
@@ -20,7 +22,7 @@ class SiteInstance;
 // Manages RenderViewHosts for a WebContents. Normally there is only one and
 // it is easy to do. But we can also have transitions of processes (and hence
 // RenderViewHosts) that can get complex.
-class RenderViewHostManager {
+class RenderViewHostManager : public NotificationObserver {
  public:
   // Functions implemented by our owner that we need.
   //
@@ -153,6 +155,10 @@ class RenderViewHostManager {
     return interstitial_page_;
   }
 
+  virtual void Observe(NotificationType type,
+                       const NotificationSource& source,
+                       const NotificationDetails& details);
+
  private:
   friend class TestWebContents;
 
@@ -216,6 +222,8 @@ class RenderViewHostManager {
   // (the InterstitialPage is self-owned, it deletes itself when hidden).
   InterstitialPage* interstitial_page_;
 
+  NotificationRegistrar registrar_;
+
   DISALLOW_COPY_AND_ASSIGN(RenderViewHostManager);
 };