Fix crash in WorkerTest.MultipleTabsQueuedSharedWorker. I could get this consistently when running …

content/browser/worker_host/worker_service_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/worker_host/worker_service_impl.h"
 
 #include <string>
 
 #include "base/command_line.h"
 #include "base/logging.h"
@@ skipping 44 matching lines @@
   for (WorkerProcessHost::Instances::iterator i = queued_workers_.begin();
        i != queued_workers_.end();) {
     i->RemoveFilters(filter);
     if (i->NumFilters() == 0) {
       i = queued_workers_.erase(i);
     } else {
       ++i;
     }
   }
 
+  for (WorkerProcessHost::Instances::iterator i =

[Andrew T Wilson (Slow), 2012/07/26 17:20:40]

Can we clarify what this is doing? Looks like we're blowing away pending shared
workers if there aren't any more filters (parent documents) associated with it?

I guess I'm confused about the difference between what we do here, and what we
do in the next for loop.

[jam, 2012/07/26 17:26:59]

I don't claim to understand the worker document set concept, so hard for me to
compare. I think the main issue here is that the filter* is stored in two
places, both in the document_set() below, but also directly on the
WorkerInstance itself. When running the test in VS, and with a few printfs, I
could see that pending_shared_workers_ had objects which pointed to deleted
filters.

+           pending_shared_workers_.begin();
+       i != pending_shared_workers_.end(); ) {
+     i->RemoveFilters(filter);
+     if (i->NumFilters() == 0) {
+      i = pending_shared_workers_.erase(i);
+    } else {
+      ++i;
+    }
+  }
+
   // Also, see if that process had any pending shared workers.
   for (WorkerProcessHost::Instances::iterator iter =
            pending_shared_workers_.begin();
        iter != pending_shared_workers_.end(); ) {
     iter->worker_document_set()->RemoveAll(filter);
     if (iter->worker_document_set()->IsEmpty()) {
       iter = pending_shared_workers_.erase(iter);
     } else {
       ++iter;
     }
@@ skipping 487 matching lines @@
   if (instance)
     return instance;
 
   // No existing pending worker - create a new one.
   WorkerProcessHost::WorkerInstance pending(url, true, name, resource_context);
   pending_shared_workers_.push_back(pending);
   return &pending_shared_workers_.back();
 }
 
 }  // namespace content