- DevToolsAgent is notified in render thread when RenderView is being detroyed.

- Methods of RenderView are called only on render thread in DevToolsAgent(earlier routing_id() was called on IO thread)

BUG=8378

Review URL: http://codereview.chromium.org/39182

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@10980 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 20 insertions, 3 deletions

diff --git a/chrome/renderer/dev_tools_agent.cc b/chrome/renderer/dev_tools_agent.cc
index 891e895..ec00906 100644
--- a/chrome/renderer/dev_tools_agent.cc
+++ b/chrome/renderer/dev_tools_agent.cc
@@ -16,6 +16,7 @@
 
 DevToolsAgent::DevToolsAgent(RenderView* view, MessageLoop* view_loop)
     : debugger_(NULL),
+      routing_id_(view->routing_id()),
       view_(view),
       view_loop_(view_loop),
       channel_(NULL),
@@ -25,6 +26,12 @@ DevToolsAgent::DevToolsAgent(RenderView* view, MessageLoop* view_loop)
 DevToolsAgent::~DevToolsAgent() {
 }
 
+// Called on render thread.
+void DevToolsAgent::RenderViewDestroyed() {
+  DCHECK(MessageLoop::current() == view_loop_);
+  view_ = NULL;
+}
+
 void DevToolsAgent::Send(const IPC::Message& tools_client_message) {
   // It's possible that this will get cleared out from under us.
   MessageLoop* io_loop = io_loop_;
@@ -32,7 +39,7 @@ void DevToolsAgent::Send(const IPC::Message& tools_client_message) {
     return;
 
   IPC::Message* m = new ViewHostMsg_ForwardToDevToolsClient(
-      view_->routing_id(),
+      routing_id_,
       tools_client_message);
   io_loop->PostTask(FROM_HERE, NewRunnableMethod(
       this, &DevToolsAgent::SendFromIOThread, m));
@@ -56,7 +63,7 @@ void DevToolsAgent::OnFilterAdded(IPC::Channel* channel) {
 bool DevToolsAgent::OnMessageReceived(const IPC::Message& message) {
   DCHECK(MessageLoop::current() == io_loop_);
 
-  if (message.routing_id() != view_->routing_id())
+  if (message.routing_id() != routing_id_)
     return false;
 
   bool handled = true;
@@ -70,6 +77,7 @@ bool DevToolsAgent::OnMessageReceived(const IPC::Message& message) {
   return handled;
 }
 
+// Called on IO thread.
 void DevToolsAgent::OnFilterRemoved() {
   io_loop_ = NULL;
   channel_ = NULL;
@@ -81,7 +89,9 @@ void DevToolsAgent::DebuggerOutput(const std::wstring& out) {
 
 void DevToolsAgent::EvaluateScript(const std::wstring& script) {
   DCHECK(MessageLoop::current() == view_loop_);
-  view_->EvaluateScript(L"", script);
+  // view_ may have been cleared after this method execution was scheduled.
+  if (view_)
+    view_->EvaluateScript(L"", script);
 }
 
 void DevToolsAgent::OnDebugAttach() {
diff --git a/chrome/renderer/dev_tools_agent.h b/chrome/renderer/dev_tools_agent.h
index c8c749e..2517163 100644
--- a/chrome/renderer/dev_tools_agent.h
+++ b/chrome/renderer/dev_tools_agent.h
@@ -28,6 +28,10 @@ class DevToolsAgent : public IPC::ChannelProxy::MessageFilter,
   explicit DevToolsAgent(RenderView* view, MessageLoop* view_loop);
   virtual ~DevToolsAgent();
 
+  // DevToolsAgent is created by RenderView which is supposed to call this
+  // method from its destructor.
+  void RenderViewDestroyed();
+
  private:
   // Sends message to DevToolsClient. May be called on any thread.
   void Send(const IPC::Message& tools_client_message);
@@ -56,6 +60,7 @@ class DevToolsAgent : public IPC::ChannelProxy::MessageFilter,
 
   scoped_refptr<DebuggerBridge> debugger_;
 
+  int routing_id_; //  View routing id that we can access from IO thread.
   RenderView* view_;
   MessageLoop* view_loop_;
 
diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index 461f99c..debff4dc 100644
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -201,6 +201,8 @@ RenderView::~RenderView() {
   }
 
   render_thread_->RemoveFilter(debug_message_handler_);
+
+  dev_tools_agent_->RenderViewDestroyed();
   render_thread_->RemoveFilter(dev_tools_agent_);
 
 #ifdef CHROME_PERSONALIZATION