|
Line
Link Here
|
| 0 |
-- a/content/browser/service_worker/service_worker_container_host.cc |
0 |
++ b/content/browser/service_worker/service_worker_container_host.cc |
|
Lines 626-631
Link Here
|
| 626 |
int64_t registration_id) { |
626 |
int64_t registration_id) { |
| 627 |
DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId()); |
627 |
DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId()); |
| 628 |
DCHECK(base::Contains(registration_object_hosts_, registration_id)); |
628 |
DCHECK(base::Contains(registration_object_hosts_, registration_id)); |
|
|
629 |
|
| 630 |
// ServiceWorkerRegistrationObjectHost to be deleted may have the last reference to |
| 631 |
// ServiceWorkerRegistration that indirectly owns this ServiceWorkerContainerHost. |
| 632 |
// If we erase the object host directly from the map, |this| could be deleted |
| 633 |
// during the map operation and may crash. To avoid the case, we take the |
| 634 |
// ownership of the object host from the map first, and then erase the entry |
| 635 |
// from the map. See https://crbug.com/1135070 for details. |
| 636 |
std::unique_ptr<ServiceWorkerRegistrationObjectHost> to_be_deleted = |
| 637 |
std::move(registration_object_hosts_[registration_id]); |
| 638 |
DCHECK(to_be_deleted); |
| 629 |
registration_object_hosts_.erase(registration_id); |
639 |
registration_object_hosts_.erase(registration_id); |
| 630 |
} |
640 |
} |
| 631 |
|
641 |
|
