3 files changed, 15 insertions, 4 deletions
diff --git a/chrome/browser/nacl_host/nacl_broker_host_win.cc b/chrome/browser/nacl_host/nacl_broker_host_win.cc
index b75481e..53f48fc 100644
--- a/chrome/browser/nacl_host/nacl_broker_host_win.cc
+++ b/chrome/browser/nacl_host/nacl_broker_host_win.cc
@@ -18,7 +18,7 @@
 #include "content/public/browser/child_process_data.h"
 #include "content/public/common/child_process_host.h"
 
-NaClBrokerHost::NaClBrokerHost() {
+NaClBrokerHost::NaClBrokerHost() : is_terminating_(false) {
   process_.reset(content::BrowserChildProcessHost::Create(
       content::PROCESS_TYPE_NACL_BROKER, this));
 }
@@ -91,5 +91,6 @@ void NaClBrokerHost::OnDebugExceptionHandlerLaunched(int32 pid, bool success) {
 }
 
 void NaClBrokerHost::StopBroker() {
+  is_terminating_ = true;
   process_->Send(new NaClProcessMsg_StopBroker());
 }
diff --git a/chrome/browser/nacl_host/nacl_broker_host_win.h b/chrome/browser/nacl_host/nacl_broker_host_win.h
index 20d6b37..278b65f 100644
--- a/chrome/browser/nacl_host/nacl_broker_host_win.h
+++ b/chrome/browser/nacl_host/nacl_broker_host_win.h
@@ -35,6 +35,11 @@ class NaClBrokerHost : public content::BrowserChildProcessHostDelegate {
   // Stop the broker process.
   void StopBroker();
 
+  // Returns true if the process has been asked to terminate. If true, this
+  // object should no longer be used; it will eventually be destroyed by
+  // BrowserChildProcessHostImpl::OnChildDisconnected()
+  bool IsTerminating() { return is_terminating_; }
+
  private:
   // Handler for NaClProcessMsg_LoaderLaunched message
   void OnLoaderLaunched(const std::string& loader_channel_id,
@@ -46,6 +51,7 @@ class NaClBrokerHost : public content::BrowserChildProcessHostDelegate {
   virtual bool OnMessageReceived(const IPC::Message& msg);
 
   scoped_ptr<content::BrowserChildProcessHost> process_;
+  bool is_terminating_;
 
   DISALLOW_COPY_AND_ASSIGN(NaClBrokerHost);
 };
diff --git a/chrome/browser/nacl_host/nacl_broker_service_win.cc b/chrome/browser/nacl_host/nacl_broker_service_win.cc
index 6426bd9..c7ad863 100644
--- a/chrome/browser/nacl_host/nacl_broker_service_win.cc
+++ b/chrome/browser/nacl_host/nacl_broker_service_win.cc
@@ -91,7 +91,11 @@ void NaClBrokerService::OnDebugExceptionHandlerLaunched(int32 pid,
 
 NaClBrokerHost* NaClBrokerService::GetBrokerHost() {
   BrowserChildProcessHostIterator iter(content::PROCESS_TYPE_NACL_BROKER);
-  if (iter.Done())
-    return NULL;
-  return static_cast<NaClBrokerHost*>(iter.GetDelegate());
+  while (!iter.Done()) {
+    NaClBrokerHost* host = static_cast<NaClBrokerHost*>(iter.GetDelegate());
+    if (!host->IsTerminating())
+      return host;
+    ++iter;
+  }
+  return NULL;
 }