Remove Unfreezable TaskRunner on RenderThreadImpl::RemoveRoute

The task runner (`base::sequence_manager::internal::TaskQueueImpl::TaskRunner`
 -- child of `base::SingleThreadTaskRunner`) being held in
`unfreezable_message_filter_` refers to an object of
`base::sequence_manager::internal::TaskQueueImpl::GuardedTaskPoster`,
which holds an object of `base::internal::OperationsController`, which
then holds an object of `base::WaitableEvent`, which finnally holds an
open mach port.

The issue also impacts other systems like Windows / Linux.

Bug: 1063577
Change-Id: I5e34c71953835d9312360d349072ec4809f00d11
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2132536Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#755872}

AUTHORS

@@ -149,6 +149,7 @@ Brian Konzman, SJ <b.g.konzman@gmail.com>
 Brian Luft <brian@electroly.com>
 Brian Merrell, Novell Inc. <bgmerrell@gmail.com>
 Brian Yip <itsbriany@gmail.com>
+Brook Hong <hzgmaxwell@gmail.com>
 Bruno Calvignac <bruno@flock.com>
 Bruno de Oliveira Abinader <brunoabinader@gmail.com>
 Bruno Roy <brusi_roy@hotmail.com>

content/renderer/render_thread_impl.cc

@@ -903,6 +903,7 @@ void RenderThreadImpl::AddRoute(int32_t routing_id, IPC::Listener* listener) {
 
 void RenderThreadImpl::RemoveRoute(int32_t routing_id) {
   ChildThreadImpl::GetRouter()->RemoveRoute(routing_id);
+  unfreezable_message_filter_->RemoveListenerUnfreezableTaskRunner(routing_id);
   GetChannel()->RemoveListenerTaskRunner(routing_id);
 }
 
@@ -2299,6 +2300,14 @@ void RenderThreadImpl::UnfreezableMessageFilter::
                                     std::move(unfreezable_task_runner));
 }
 
+// Called on the listener thread.
+void RenderThreadImpl::UnfreezableMessageFilter::
+    RemoveListenerUnfreezableTaskRunner(
+        int32_t routing_id) {
+  base::AutoLock lock(unfreezable_task_runners_lock_);
+  unfreezable_task_runners_.erase(routing_id);
+}
+
 // Called on the I/O thread.
 scoped_refptr<base::SingleThreadTaskRunner>
 RenderThreadImpl::UnfreezableMessageFilter::GetUnfreezableTaskRunner(

content/renderer/render_thread_impl.h

@@ -328,6 +328,10 @@ class CONTENT_EXPORT RenderThreadImpl
         int32_t routing_id,
         scoped_refptr<base::SingleThreadTaskRunner> unfreezable_task_runner);
 
+    // Removes |unfreezable_task_runner| for the task to be executed later.
+    void RemoveListenerUnfreezableTaskRunner(
+        int32_t routing_id);
+
     // Called on the I/O thread.
     // Returns the unfreezable task runner associated with |routing_id|.
     scoped_refptr<base::SingleThreadTaskRunner> GetUnfreezableTaskRunner(