2 files changed, 19 insertions, 3 deletions
diff --git a/chrome/browser/render_widget_helper.cc b/chrome/browser/render_widget_helper.cc
index 6536220..d2554e6 100644
--- a/chrome/browser/render_widget_helper.cc
+++ b/chrome/browser/render_widget_helper.cc
@@ -19,9 +19,18 @@ class RenderWidgetHelper::PaintMsgProxy : public Task {
         cancelled(false) {
   }
 
+  ~PaintMsgProxy() {
+    // If the paint message was never dispatched, then we need to let the
+    // helper know that we are going away.
+    if (!cancelled && helper)
+      helper->OnDiscardPaintMsg(this);
+  }
+
   virtual void Run() {
-    if (!cancelled)
+    if (!cancelled) {
       helper->OnDispatchPaintMsg(this);
+      helper = NULL;
+    }
   }
 
   scoped_refptr<RenderWidgetHelper> helper;
@@ -141,7 +150,7 @@ void RenderWidgetHelper::DidReceivePaintMsg(const IPC::Message& msg) {
   ui_loop_->PostTask(FROM_HERE, proxy);
 }
 
-void RenderWidgetHelper::OnDispatchPaintMsg(PaintMsgProxy* proxy) {
+void RenderWidgetHelper::OnDiscardPaintMsg(PaintMsgProxy* proxy) {
   const IPC::Message& msg = proxy->message;
 
   // Remove the proxy from the map now that we are going to handle it normally.
@@ -154,11 +163,15 @@ void RenderWidgetHelper::OnDispatchPaintMsg(PaintMsgProxy* proxy) {
 
     pending_paints_.erase(it);
   }
+}
+
+void RenderWidgetHelper::OnDispatchPaintMsg(PaintMsgProxy* proxy) {
+  OnDiscardPaintMsg(proxy);
 
   // It is reasonable for the host to no longer exist.
   RenderProcessHost* host = RenderProcessHost::FromID(render_process_id_);
   if (host)
-    host->OnMessageReceived(msg);
+    host->OnMessageReceived(proxy->message);
 }
 
 void RenderWidgetHelper::OnCancelResourceRequests(
diff --git a/chrome/browser/render_widget_helper.h b/chrome/browser/render_widget_helper.h
index c7763b4..6098289 100644
--- a/chrome/browser/render_widget_helper.h
+++ b/chrome/browser/render_widget_helper.h
@@ -121,6 +121,9 @@ class RenderWidgetHelper :
   // Map from render_widget_id to live PaintMsgProxy instance.
   typedef base::hash_map<int, PaintMsgProxy*> PaintMsgProxyMap;
 
+  // Called on the UI thread to discard a paint message.
+  void OnDiscardPaintMsg(PaintMsgProxy* proxy);
+
   // Called on the UI thread to dispatch a paint message if necessary.
   void OnDispatchPaintMsg(PaintMsgProxy* proxy);