The iterator used to walk through the set of throbbers might become invalid

if a throbber decides it's done animating during the walk.  This might happen
for toast throbbers, like the sad tab icon.

TEST=none, really
BUG=20907
Review URL: http://codereview.chromium.org/185016

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@25316 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 11 insertions, 4 deletions

diff --git a/chrome/browser/cocoa/throbber_view.mm b/chrome/browser/cocoa/throbber_view.mm
index a83d6a5..729b6b4 100644
--- a/chrome/browser/cocoa/throbber_view.mm
+++ b/chrome/browser/cocoa/throbber_view.mm
@@ -269,11 +269,18 @@ typedef std::set<ThrobberView*> ThrobberSet;
 }
 
 - (void)fire:(NSTimer*)timer {
-  for (ThrobberSet::const_iterator i = throbbers_.begin();
-       i != throbbers_.end();
-       ++i) {
-    ThrobberView* throbber = *i;
+  // The call to [throbber animate] may result in the ThrobberView calling
+  // removeThrobber: if it decides it's done animating.  That would invalidate
+  // the iterator, making it impossible to correctly get to the next element
+  // in the set.  To prevent that from happening, a second iterator is used
+  // and incremented before calling [throbber animate].
+  ThrobberSet::const_iterator current = throbbers_.begin();
+  ThrobberSet::const_iterator next = current;
+  while (current != throbbers_.end()) {
+    ++next;
+    ThrobberView* throbber = *current;
     [throbber animate];
+    current = next;
   }
 }
 @end