1 files changed, 34 insertions, 7 deletions

diff --git a/webkit/glue/websocketstreamhandle_impl.cc b/webkit/glue/websocketstreamhandle_impl.cc
index b72c718..48cdeea 100644
--- a/webkit/glue/websocketstreamhandle_impl.cc
+++ b/webkit/glue/websocketstreamhandle_impl.cc
@@ -37,6 +37,10 @@ class WebSocketStreamHandleImpl::Context
   bool Send(const WebKit::WebData& data);
   void Close();
 
+  // Must be called before |handle_| or |client_| is deleted.
+  // Once detached, it never calls |client_| back.
+  void Detach();
+
   // WebSocketStreamHandleDelegate methods:
   virtual void WillOpenStream(WebKit::WebSocketStreamHandle*, const GURL&);
   virtual void DidOpenStream(WebKit::WebSocketStreamHandle*, int);
@@ -47,10 +51,16 @@ class WebSocketStreamHandleImpl::Context
 
  private:
   friend class base::RefCounted<Context>;
-  ~Context() {}
+  ~Context() {
+    DCHECK(!handle_);
+    DCHECK(!client_);
+    DCHECK(!bridge_);
+  }
 
   WebSocketStreamHandleImpl* handle_;
   WebKit::WebSocketStreamHandleClient* client_;
+  // |bridge_| is alive from Connect to DidClose, so Context must be alive
+  // in the time period.
   WebSocketStreamHandleBridge* bridge_;
 
   DISALLOW_COPY_AND_ASSIGN(Context);
@@ -59,13 +69,14 @@ class WebSocketStreamHandleImpl::Context
 WebSocketStreamHandleImpl::Context::Context(WebSocketStreamHandleImpl* handle)
     : handle_(handle),
       client_(NULL),
-      bridge_(ALLOW_THIS_IN_INITIALIZER_LIST(
-          WebSocketStreamHandleBridge::Create(handle_, this))) {
+      bridge_(NULL) {
 }
 
 void WebSocketStreamHandleImpl::Context::Connect(const WebKit::WebURL& url) {
   LOG(INFO) << "Connect url=" << url;
-  DCHECK(bridge_);
+  DCHECK(!bridge_);
+  bridge_ = WebSocketStreamHandleBridge::Create(handle_, this);
+  AddRef();  // Will be released by DidClose().
   bridge_->Connect(url);
 }
 
@@ -82,6 +93,17 @@ void WebSocketStreamHandleImpl::Context::Close() {
     bridge_->Close();
 }
 
+void WebSocketStreamHandleImpl::Context::Detach() {
+  handle_ = NULL;
+  client_ = NULL;
+  // If Connect was called, |bridge_| is not NULL, so that this Context closes
+  // the |bridge_| here.  Then |bridge_| will call back DidClose, in which
+  // this Context will delete the |bridge_|.
+  // Otherwise, |bridge_| is NULL.
+  if (bridge_)
+    bridge_->Close();
+}
+
 void WebSocketStreamHandleImpl::Context::WillOpenStream(
     WebKit::WebSocketStreamHandle* web_handle, const GURL& url) {
   LOG(INFO) << "WillOpenStream url=" << url;
@@ -111,14 +133,16 @@ void WebSocketStreamHandleImpl::Context::DidReceiveData(
 void WebSocketStreamHandleImpl::Context::DidClose(
     WebKit::WebSocketStreamHandle* web_handle) {
   LOG(INFO) << "DidClose";
-  bridge_ = 0;
+  delete bridge_;
+  bridge_ = NULL;
   WebSocketStreamHandleImpl* handle = handle_;
-  handle_ = 0;
+  handle_ = NULL;
   if (client_) {
     WebKit::WebSocketStreamHandleClient* client = client_;
     client_ = NULL;
     client->didClose(handle);
   }
+  Release();
 }
 
 // WebSocketStreamHandleImpl ------------------------------------------------
@@ -128,7 +152,10 @@ WebSocketStreamHandleImpl::WebSocketStreamHandleImpl()
 }
 
 WebSocketStreamHandleImpl::~WebSocketStreamHandleImpl() {
-  close();
+  // We won't receive any events from |context_|.
+  // |context_| is ref counted, and will be released when it received
+  // DidClose.
+  context_->Detach();
 }
 
 void WebSocketStreamHandleImpl::connect(