Fix threading and ownership issues in WebWorkerClientProxy.

Review URL: http://codereview.chromium.org/42469

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@12230 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 25 insertions, 9 deletions

diff --git a/chrome/worker/webworkerclient_proxy.cc b/chrome/worker/webworkerclient_proxy.cc
index 7b351b0..6cc3d9b 100644
--- a/chrome/worker/webworkerclient_proxy.cc
+++ b/chrome/worker/webworkerclient_proxy.cc
@@ -15,6 +15,7 @@ WebWorkerClientProxy::WebWorkerClientProxy(const GURL& url, int route_id)
     : url_(url),
       route_id_(route_id),
       ALLOW_THIS_IN_INITIALIZER_LIST(impl_(WebWorker::Create(this))) {
+  AddRef();
   WorkerThread::current()->AddRoute(route_id_, this);
   WorkerProcess::current()->AddRefProcess();
 }
@@ -60,22 +61,33 @@ void WebWorkerClientProxy::ReportPendingActivity(bool has_pending_activity) {
 
 void WebWorkerClientProxy::WorkerContextDestroyed() {
   Send(new WorkerHostMsg_WorkerContextDestroyed(route_id_));
+  impl_ = NULL;
+
+  WorkerThread::current()->message_loop()->ReleaseSoon(FROM_HERE, this);
 }
 
 bool WebWorkerClientProxy::Send(IPC::Message* message) {
+  if (MessageLoop::current() != WorkerThread::current()->message_loop()) {
+    WorkerThread::current()->message_loop()->PostTask(FROM_HERE,
+        NewRunnableMethod(this, &WebWorkerClientProxy::Send, message));
+    return true;
+  }
+
   return WorkerThread::current()->Send(message);
 }
 
 void WebWorkerClientProxy::OnMessageReceived(const IPC::Message& message) {
-  WebWorker* worker = impl_.get();
+  if (!impl_)
+    return;
+
   IPC_BEGIN_MESSAGE_MAP(WebWorkerClientProxy, message)
-    IPC_MESSAGE_FORWARD(WorkerMsg_StartWorkerContext, worker,
+    IPC_MESSAGE_FORWARD(WorkerMsg_StartWorkerContext, impl_,
                         WebWorker::StartWorkerContext)
-    IPC_MESSAGE_FORWARD(WorkerMsg_TerminateWorkerContext, worker,
+    IPC_MESSAGE_FORWARD(WorkerMsg_TerminateWorkerContext, impl_,
                         WebWorker::TerminateWorkerContext)
-    IPC_MESSAGE_FORWARD(WorkerMsg_PostMessageToWorkerContext, worker,
+    IPC_MESSAGE_FORWARD(WorkerMsg_PostMessageToWorkerContext, impl_,
                         WebWorker::PostMessageToWorkerContext)
-    IPC_MESSAGE_FORWARD(WorkerMsg_WorkerObjectDestroyed, worker,
+    IPC_MESSAGE_FORWARD(WorkerMsg_WorkerObjectDestroyed, impl_,
                         WebWorker::WorkerObjectDestroyed)
   IPC_END_MESSAGE_MAP()
 }
diff --git a/chrome/worker/webworkerclient_proxy.h b/chrome/worker/webworkerclient_proxy.h
index 094bdeb..31ee56d 100644
--- a/chrome/worker/webworkerclient_proxy.h
+++ b/chrome/worker/webworkerclient_proxy.h
@@ -6,7 +6,7 @@
 #define CHROME_WORKER_WEBWORKERCLIENT_PROXY_H_
 
 #include "base/basictypes.h"
-#include "base/scoped_ptr.h"
+#include "base/ref_counted.h"
 #include "chrome/common/ipc_channel.h"
 #include "googleurl/src/gurl.h"
 #include "webkit/glue/webworkerclient.h"
@@ -19,10 +19,10 @@ class WebWorker;
 // IPCs that are sent to the renderer, where they're converted back to function
 // calls by WebWorkerProxy.
 class WebWorkerClientProxy : public WebWorkerClient,
-                             public IPC::Channel::Listener {
+                             public IPC::Channel::Listener,
+                             public base::RefCounted<WebWorkerClientProxy> {
  public:
   WebWorkerClientProxy (const GURL& url, int route_id);
-  ~WebWorkerClientProxy ();
 
   // WebWorkerClient implementation.
   void PostMessageToWorkerObject(const string16& message);
@@ -45,6 +45,9 @@ class WebWorkerClientProxy : public WebWorkerClient,
   void OnMessageReceived(const IPC::Message& message);
 
  private:
+  friend class base::RefCounted<WebWorkerClientProxy>;
+  ~WebWorkerClientProxy ();
+
   bool Send(IPC::Message* message);
 
   // The source url for this worker.
@@ -52,7 +55,7 @@ class WebWorkerClientProxy : public WebWorkerClient,
 
   int route_id_;
 
-  scoped_ptr<WebWorker> impl_;
+  WebWorker* impl_;
 
   DISALLOW_COPY_AND_ASSIGN(WebWorkerClientProxy);
 };
diff --git a/chrome/worker/worker_thread.cc b/chrome/worker/worker_thread.cc
index c48eae0..8091dbf 100644
--- a/chrome/worker/worker_thread.cc
+++ b/chrome/worker/worker_thread.cc
@@ -42,5 +42,6 @@ void WorkerThread::OnControlMessageReceived(const IPC::Message& msg) {
 }
 
 void WorkerThread::OnCreateWorker(const GURL& url, int route_id) {
+  // WebWorkerClientProxy owns itself.
   WebWorkerClientProxy* worker = new WebWorkerClientProxy(url, route_id);
 }