Fix a refcounting memory bug.

BUG=none
TEST=none

Review URL: http://codereview.chromium.org/552222

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@37466 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 12 insertions, 10 deletions

diff --git a/webkit/appcache/appcache_group.cc b/webkit/appcache/appcache_group.cc
index e1906ab..0b3f496 100644
--- a/webkit/appcache/appcache_group.cc
+++ b/webkit/appcache/appcache_group.cc
@@ -245,16 +245,18 @@ void AppCacheGroup::SetUpdateStatus(UpdateStatus status) {
   } else {
     update_job_ = NULL;
 
-    // Check member variable before notifying observers about update finishing.
-    // Observers may remove reference to group, causing group to be deleted
-    // after the notifications. If there are queued updates, then the group
-    // will continue to exist.
-    bool restart_update = !queued_updates_.empty();
-
-    FOR_EACH_OBSERVER(UpdateObserver, observers_, OnUpdateComplete(this));
-
-    if (restart_update)
-      ScheduleUpdateRestart(kUpdateRestartDelayMs);
+    // Note, this method may be called from within our destructor so we have
+    // to be careful about calling addref and release in here. If there are
+    // any observers, this will not be the case since each observer will have
+    // a reference to us.
+    if (observers_.size() || queued_observers_.size()) {
+      // Observers may release us in these callbacks, so we protect against
+      // deletion by adding an extra ref in this scope.
+      scoped_refptr<AppCacheGroup> protect(this);
+      FOR_EACH_OBSERVER(UpdateObserver, observers_, OnUpdateComplete(this));
+      if (!queued_updates_.empty())
+        ScheduleUpdateRestart(kUpdateRestartDelayMs);
+    }
   }
 }