5 files changed, 55 insertions, 0 deletions

diff --git a/base/shared_memory.h b/base/shared_memory.h
index a368d9f..ea72069 100644
--- a/base/shared_memory.h
+++ b/base/shared_memory.h
@@ -61,6 +61,9 @@ class SharedMemory {
   // Return invalid handle (see comment above for exact definition).
   static SharedMemoryHandle NULLHandle();
 
+  // Close a shared memory handle.
+  static void CloseHandle(const SharedMemoryHandle& handle);
+
   // Creates or opens a shared memory segment based on a name.
   // If read_only is true, opens the memory as read-only.
   // If open_existing is true, and the shared memory already exists,
diff --git a/base/shared_memory_posix.cc b/base/shared_memory_posix.cc
index 2f0fe22..fe4b225 100644
--- a/base/shared_memory_posix.cc
+++ b/base/shared_memory_posix.cc
@@ -70,6 +70,12 @@ SharedMemoryHandle SharedMemory::NULLHandle() {
   return SharedMemoryHandle();
 }
 
+// static
+void SharedMemory::CloseHandle(const SharedMemoryHandle& handle) {
+  DCHECK(handle.fd >= 0);
+  close(handle.fd);
+}
+
 bool SharedMemory::Create(const std::wstring &name, bool read_only,
                           bool open_existing, size_t size) {
   read_only_ = read_only;
diff --git a/base/shared_memory_win.cc b/base/shared_memory_win.cc
index 66f8fb6..dd4c73b 100644
--- a/base/shared_memory_win.cc
+++ b/base/shared_memory_win.cc
@@ -55,6 +55,12 @@ SharedMemoryHandle SharedMemory::NULLHandle() {
   return NULL;
 }
 
+// static
+void SharedMemory::CloseHandle(const SharedMemoryHandle& handle) {
+  DCHECK(handle != NULL);
+  ::CloseHandle(handle);
+}
+
 bool SharedMemory::Create(const std::wstring &name, bool read_only,
                           bool open_existing, size_t size) {
   DCHECK(mapped_file_ == NULL);
diff --git a/chrome/common/resource_dispatcher.cc b/chrome/common/resource_dispatcher.cc
index c669d43..e879c36 100644
--- a/chrome/common/resource_dispatcher.cc
+++ b/chrome/common/resource_dispatcher.cc
@@ -276,6 +276,8 @@ bool ResourceDispatcher::OnMessageReceived(const IPC::Message& message) {
     // This might happen for kill()ed requests on the webkit end, so perhaps it
     // shouldn't be a warning...
     DLOG(WARNING) << "Got response for a nonexistant or finished request";
+    // Release resources in the message if it is a data message.
+    ReleaseResourcesInDataMessage(message);
     return true;
   }
 
@@ -467,6 +469,17 @@ bool ResourceDispatcher::RemovePendingRequest(int request_id) {
   PendingRequestList::iterator it = pending_requests_.find(request_id);
   if (it == pending_requests_.end())
     return false;
+
+  // Iterate through the deferred message queue and clean up the messages.
+  PendingRequestInfo& request_info = it->second;
+  MessageQueue& q = request_info.deferred_message_queue;
+  while (!q.empty()) {
+    IPC::Message* m = q.front();
+    ReleaseResourcesInDataMessage(*m);
+    q.pop_front();
+    delete m;
+  }
+
   pending_requests_.erase(it);
   return true;
 }
@@ -559,3 +572,24 @@ bool ResourceDispatcher::IsResourceDispatcherMessage(
 
   return false;
 }
+
+void ResourceDispatcher::ReleaseResourcesInDataMessage(
+    const IPC::Message& message) {
+  void* iter = NULL;
+  int request_id;
+  if (!message.ReadInt(&iter, &request_id)) {
+    NOTREACHED() << "malformed resource message";
+    return;
+  }
+
+  // If the message contains a shared memory handle, we should close the
+  // handle or there will be a memory leak.
+  if (message.type() == ViewMsg_Resource_DataReceived::ID) {
+    base::SharedMemoryHandle shm_handle;
+    if (IPC::ParamTraits<base::SharedMemoryHandle>::Read(&message,
+                                                         &iter,
+                                                         &shm_handle)) {
+      base::SharedMemory::CloseHandle(shm_handle);
+    }
+  }
+}
diff --git a/chrome/common/resource_dispatcher.h b/chrome/common/resource_dispatcher.h
index 8ad20fe..f4494a5 100644
--- a/chrome/common/resource_dispatcher.h
+++ b/chrome/common/resource_dispatcher.h
@@ -114,6 +114,12 @@ class ResourceDispatcher {
   // Returns true if the message passed in is a resource related message.
   static bool IsResourceDispatcherMessage(const IPC::Message& message);
 
+  // ViewHostMsg_Resource_DataReceived is not POD, it has a shared memory
+  // handle in it that we should cleanup it up nicely. This method accepts any
+  // message and determine whether the message is
+  // ViewHostMsg_Resource_DataReceived and clean up the shared memory handle.
+  void ReleaseResourcesInDataMessage(const IPC::Message& message);
+
   IPC::Message::Sender* message_sender_;
 
   // All pending requests issued to the host