1 files changed, 11 insertions, 22 deletions

diff --git a/chrome/common/child_process_host.cc b/chrome/common/child_process_host.cc
index c2c925e..67d9a5a 100644
--- a/chrome/common/child_process_host.cc
+++ b/chrome/common/child_process_host.cc
@@ -51,8 +51,7 @@ ChildProcessHost::ChildProcessHost(
     : Receiver(type),
       ALLOW_THIS_IN_INITIALIZER_LIST(listener_(this)),
       resource_dispatcher_host_(resource_dispatcher_host),
-      opening_channel_(false),
-      process_event_(NULL) {
+      opening_channel_(false) {
   Singleton<ChildProcessList>::get()->push_back(this);
 }
 
@@ -62,16 +61,8 @@ ChildProcessHost::~ChildProcessHost() {
 
   resource_dispatcher_host_->CancelRequestsForProcess(GetProcessId());
 
-  if (handle()) {
-    watcher_.StopWatching();
+  if (handle())
     ProcessWatcher::EnsureProcessTerminated(handle());
-
-#if defined(OS_WIN)
-    // Above call took ownership, so don't want WaitableEvent to assert because
-    // the handle isn't valid anymore.
-    process_event_->Release();
-#endif
-  }
 }
 
 bool ChildProcessHost::CreateChannel() {
@@ -87,13 +78,8 @@ bool ChildProcessHost::CreateChannel() {
 }
 
 void ChildProcessHost::SetHandle(base::ProcessHandle process) {
-#if defined(OS_WIN)
-  process_event_.reset(new base::WaitableEvent(process));
-
   DCHECK(!handle());
   set_handle(process);
-  watcher_.StartWatching(process_event_.get(), this);
-#endif
 }
 
 void ChildProcessHost::InstanceCreated() {
@@ -113,20 +99,20 @@ void ChildProcessHost::Notify(NotificationType type) {
       FROM_HERE, new ChildNotificationTask(type, this));
 }
 
-void ChildProcessHost::OnWaitableEventSignaled(base::WaitableEvent *event) {
-#if defined(OS_WIN)
-  HANDLE object = event->handle();
+void ChildProcessHost::OnChildDied() {
   DCHECK(handle());
-  DCHECK_EQ(object, handle());
 
-  bool did_crash = base::DidProcessCrash(NULL, object);
+  bool did_crash = base::DidProcessCrash(NULL, handle());
   if (did_crash) {
     // Report that this child process crashed.
     Notify(NotificationType::CHILD_PROCESS_CRASHED);
   }
   // Notify in the main loop of the disconnection.
   Notify(NotificationType::CHILD_PROCESS_HOST_DISCONNECTED);
-#endif
+
+  // On POSIX, once we've called DidProcessCrash, handle() is no longer
+  // valid.  Ensure the destructor doesn't try to use it.
+  set_handle(NULL);
 
   delete this;
 }
@@ -185,6 +171,9 @@ void ChildProcessHost::ListenerHook::OnChannelConnected(int32 peer_pid) {
 void ChildProcessHost::ListenerHook::OnChannelError() {
   host_->opening_channel_ = false;
   host_->OnChannelError();
+
+  // This will delete host_, which will also destroy this!
+  host_->OnChildDied();
 }