Fix a crash in chrome.exe caused by the external tab container instance getting destroyed without

going through the proper window shutdown sequence when the external host crashes.

The fix is to ensure that we clean up correctly when the external tab instance goes away. Will add a unit test in a subsequent CB.

Bug=1688967

Review URL: http://codereview.chromium.org/39086

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@10962 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 18 insertions, 7 deletions

diff --git a/chrome/browser/external_tab_container.cc b/chrome/browser/external_tab_container.cc
index 216d171..e637a16 100644
--- a/chrome/browser/external_tab_container.cc
+++ b/chrome/browser/external_tab_container.cc
@@ -35,6 +35,7 @@ ExternalTabContainer::ExternalTabContainer(
 }
 
 ExternalTabContainer::~ExternalTabContainer() {
+  Uninitialize(m_hWnd);
 }
 
 bool ExternalTabContainer::Init(Profile* profile, HWND parent,
@@ -120,16 +121,18 @@ bool ExternalTabContainer::Init(Profile* profile, HWND parent,
     SetParent(parent);
 
   ::ShowWindow(tab_contents_->GetNativeView(), SW_SHOWNA);
-
   return true;
 }
 
-void ExternalTabContainer::OnDestroy() {
-  views::FocusManager* focus_manager =
-      views::FocusManager::GetFocusManager(GetHWND());
-  if (focus_manager) {
-    focus_manager->RemoveKeystrokeListener(this);
+bool ExternalTabContainer::Uninitialize(HWND window) {
+  if (::IsWindow(window)) {
+    views::FocusManager* focus_manager =
+        views::FocusManager::GetFocusManager(window);
+    if (focus_manager) {
+      focus_manager->RemoveKeystrokeListener(this);
+    }
   }
+
   root_view_.RemoveAllChildViews(true);
   if (tab_contents_) {
     NavigationController* controller = tab_contents_->controller();
@@ -139,14 +142,18 @@ void ExternalTabContainer::OnDestroy() {
         NotificationType::EXTERNAL_TAB_CLOSED,
         Source<NavigationController>(controller),
         Details<ExternalTabContainer>(this));
+
     tab_contents_->set_delegate(NULL);
     tab_contents_->CloseContents();
     // WARNING: tab_contents_ has likely been deleted.
     tab_contents_ = NULL;
   }
+
+  return true;
 }
 
 void ExternalTabContainer::OnFinalMessage(HWND window) {
+  Uninitialize(window);
   delete this;
 }
 
diff --git a/chrome/browser/external_tab_container.h b/chrome/browser/external_tab_container.h
index f786606..1bde9f9 100644
--- a/chrome/browser/external_tab_container.h
+++ b/chrome/browser/external_tab_container.h
@@ -41,7 +41,6 @@ class ExternalTabContainer : public TabContentsDelegate,
   BEGIN_MSG_MAP(ExternalTabContainer)
     MESSAGE_HANDLER(WM_SIZE, OnSize)
     MESSAGE_HANDLER(WM_SETFOCUS, OnSetFocus)
-    MSG_WM_DESTROY(OnDestroy)
   END_MSG_MAP()
 
   DECLARE_WND_CLASS(chrome::kExternalTabWindowClass)
@@ -56,6 +55,11 @@ class ExternalTabContainer : public TabContentsDelegate,
   bool Init(Profile* profile, HWND parent, const gfx::Rect& dimensions,
             unsigned int style);
 
+  // This function gets called from two places, which is fine.
+  // 1. OnFinalMessage
+  // 2. In the destructor.
+  bool Uninitialize(HWND window);
+
   // Overridden from TabContentsDelegate:
   virtual void OpenURLFromTab(TabContents* source,
                               const GURL& url,