extensions: Destroy ExtensionMessageFilter on IO thread.

Avoid a crash in tests caused by
WeakPtr<ExtensionMessageFilter>s being used on the IO thread
while the filter is destroyed on the UI thread.

BUG=376634

Review URL: https://codereview.chromium.org/309123002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@274382 0039d316-1c4b-4281-b951-d872f2087c98

extensions/browser/extension_message_filter.cc

@@ -31,7 +31,9 @@ ExtensionMessageFilter::ExtensionMessageFilter(int render_process_id,
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 }
 
-ExtensionMessageFilter::~ExtensionMessageFilter() {}
+ExtensionMessageFilter::~ExtensionMessageFilter() {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+}
 
 void ExtensionMessageFilter::OverrideThreadForMessage(
     const IPC::Message& message,
@@ -53,6 +55,12 @@ void ExtensionMessageFilter::OverrideThreadForMessage(
   }
 }
 
+void ExtensionMessageFilter::OnDestruct() const {
+  // Destroy the filter on the IO thread since that's where its weak pointers
+  // are being used.
+  BrowserThread::DeleteOnIOThread::Destruct(this);
+}
+
 bool ExtensionMessageFilter::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(ExtensionMessageFilter, message)

extensions/browser/extension_message_filter.h

@@ -38,12 +38,16 @@ class ExtensionMessageFilter : public content::BrowserMessageFilter {
   int render_process_id() { return render_process_id_; }
 
  private:
+  friend class content::BrowserThread;
+  friend class base::DeleteHelper<ExtensionMessageFilter>;
+
   virtual ~ExtensionMessageFilter();
 
   // content::BrowserMessageFilter implementation.
   virtual void OverrideThreadForMessage(
       const IPC::Message& message,
       content::BrowserThread::ID* thread) OVERRIDE;
+  virtual void OnDestruct() const OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
   // Message handlers on the UI thread.
@@ -82,6 +86,7 @@ class ExtensionMessageFilter : public content::BrowserMessageFilter {
 
   scoped_refptr<extensions::InfoMap> extension_info_map_;
 
+  // Weak pointers produced by this factory are bound to the IO thread.
   base::WeakPtrFactory<ExtensionMessageFilter> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ExtensionMessageFilter);