A crasher can happen in the AlternateNavURLFetcher if the fetch finishes after the tab has been closed.

At that point the navigation controller the AlternateNavURLFetcher has been deleted and should not be accessed.
This CL also addresses a memory leak that would happen when the fetch would fail.

BUG=http://crbug.com/17044
TEST=Navigate to an internal URL (ex: http//mylocalserver) by only typing its name (mylocalserver), an infobar asking whether you want to go to http//mylocalserver should be shown.
Review URL: http://codereview.chromium.org/187016

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@25289 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 14 insertions, 2 deletions

diff --git a/chrome/browser/alternate_nav_url_fetcher.cc b/chrome/browser/alternate_nav_url_fetcher.cc
index 0ed7b88..a8f7838 100644
--- a/chrome/browser/alternate_nav_url_fetcher.cc
+++ b/chrome/browser/alternate_nav_url_fetcher.cc
@@ -40,6 +40,8 @@ void AlternateNavURLFetcher::Observe(NotificationType type,
                         NotificationService::AllSources());
       registrar_.Add(this, NotificationType::NAV_ENTRY_COMMITTED,
                      Source<NavigationController>(controller_));
+      registrar_.Add(this, NotificationType::TAB_CLOSED,
+                     Source<NavigationController>(controller_));
 
       DCHECK_EQ(NOT_STARTED, state_);
       state_ = IN_PROGRESS;
@@ -58,6 +60,13 @@ void AlternateNavURLFetcher::Observe(NotificationType type,
       ShowInfobarIfPossible();
       break;
 
+    case NotificationType::TAB_CLOSED:
+      // We have been closed. In order to prevent the URLFetcher from trying to
+      // access the controller that will be invalid, we delete ourselves.
+      // This deletes the URLFetcher and insures its callback won't be called.
+      delete this;
+      break;
+
     default:
       NOTREACHED();
   }
@@ -75,10 +84,10 @@ void AlternateNavURLFetcher::OnURLFetchComplete(const URLFetcher* source,
       (((response_code / 100) == 2) ||
        (response_code == 401) || (response_code == 407))) {
     state_ = SUCCEEDED;
-    ShowInfobarIfPossible();
   } else {
     state_ = FAILED;
   }
+  ShowInfobarIfPossible();
 }
 
 std::wstring AlternateNavURLFetcher::GetMessageTextWithOffset(
@@ -116,8 +125,11 @@ void AlternateNavURLFetcher::InfoBarClosed() {
 }
 
 void AlternateNavURLFetcher::ShowInfobarIfPossible() {
-  if (!navigated_to_entry_ || state_ != SUCCEEDED)
+  if (!navigated_to_entry_ || state_ != SUCCEEDED) {
+    if (state_ == FAILED)
+      delete this;
     return;
+  }
 
   infobar_contents_ = controller_->tab_contents();
   StoreActiveEntryUniqueID(infobar_contents_);