Linux: Delay the deletion of the RWHVGtk object.

This object may be deleted within a signal handler for its widget, which causes a DCHECK.  Fix by using MessageLoop::DeleteSoon() instead.

BUG=http://www.crbug.com/11847
TEST=Open browser, navigate to www.google.com.  Navigate to www.yahoo.com.  This will delete the old RWHV.  It shouldn't crash.

Review URL: http://codereview.chromium.org/113316

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@16039 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 7 insertions, 25 deletions

diff --git a/chrome/browser/gtk/browser_window_gtk.cc b/chrome/browser/gtk/browser_window_gtk.cc
index 5a04c61..bf441a5 100644
--- a/chrome/browser/gtk/browser_window_gtk.cc
+++ b/chrome/browser/gtk/browser_window_gtk.cc
@@ -273,8 +273,7 @@ BrowserWindowGtk::BrowserWindowGtk(Browser* browser)
     :  browser_(browser),
        // TODO(port): make this a pref.
        custom_frame_(false),
-       full_screen_(false),
-       method_factory_(this) {
+       full_screen_(false) {
   window_ = GTK_WINDOW(gtk_window_new(GTK_WINDOW_TOPLEVEL));
   SetWindowIcon();
   SetGeometryHints();
@@ -783,18 +782,7 @@ gboolean BrowserWindowGtk::OnGtkAccelerator(GtkAccelGroup* accel_group,
                                             GdkModifierType modifier,
                                             BrowserWindowGtk* browser_window) {
   int command_id = GetCommandId(keyval, modifier);
-  // We have to delay certain commands that may try to destroy widgets to which
-  // GTK is currently holding a reference. (For now the only such command is
-  // tab closing.) GTK will hold a reference on the RWHV widget when the
-  // event came through on that widget but GTK focus was elsewhere.
-  if (IDC_CLOSE_TAB == command_id) {
-    MessageLoop::current()->PostTask(FROM_HERE,
-        browser_window->method_factory_.NewRunnableMethod(
-            &BrowserWindowGtk::ExecuteBrowserCommand,
-            command_id));
-  } else {
-    browser_window->ExecuteBrowserCommand(command_id);
-  }
+  browser_window->ExecuteBrowserCommand(command_id);
 
   return TRUE;
 }
diff --git a/chrome/browser/gtk/browser_window_gtk.h b/chrome/browser/gtk/browser_window_gtk.h
index cb6e0d5..f292cdf 100644
--- a/chrome/browser/gtk/browser_window_gtk.h
+++ b/chrome/browser/gtk/browser_window_gtk.h
@@ -9,7 +9,6 @@
 
 #include "base/gfx/rect.h"
 #include "base/scoped_ptr.h"
-#include "base/task.h"
 #include "base/timer.h"
 #include "chrome/browser/browser_window.h"
 #include "chrome/browser/tabs/tab_strip_model.h"
@@ -187,10 +186,6 @@ class BrowserWindowGtk : public BrowserWindow,
   // The container for info bars. Always non-NULL.
   scoped_ptr<InfoBarContainerGtk> infobar_container_;
 
-  // When it goes out of scope during our destruction, |method_factory_| will
-  // cancel its pending tasks (which depend on us still existing).
-  ScopedRunnableMethodFactory<BrowserWindowGtk> method_factory_;
-
   // The timer used to update frames for the Loading Animation.
   base::RepeatingTimer<BrowserWindowGtk> loading_animation_timer_;
 
diff --git a/chrome/browser/renderer_host/render_widget_host_view_gtk.cc b/chrome/browser/renderer_host/render_widget_host_view_gtk.cc
index d2e3a19..38faf57 100644
--- a/chrome/browser/renderer_host/render_widget_host_view_gtk.cc
+++ b/chrome/browser/renderer_host/render_widget_host_view_gtk.cc
@@ -10,7 +10,9 @@
 #include <cairo/cairo.h>
 
 #include "base/logging.h"
+#include "base/message_loop.h"
 #include "base/string_util.h"
+#include "base/task.h"
 #include "chrome/common/native_web_keyboard_event.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/x11_util.h"
@@ -166,6 +168,7 @@ RenderWidgetHostViewGtk::RenderWidgetHostViewGtk(RenderWidgetHost* widget_host)
 }
 
 RenderWidgetHostViewGtk::~RenderWidgetHostViewGtk() {
+  view_.Destroy();
 }
 
 void RenderWidgetHostViewGtk::InitAsChild() {
@@ -305,11 +308,7 @@ void RenderWidgetHostViewGtk::Destroy() {
     gtk_widget_destroy(gtk_widget_get_parent(view_.get()));
   }
 
-  // We need to disconnect ourselves from our parent widget at this time; this
-  // does the right thing, automatically removing ourselves from our parent
-  // container.
-  view_.Destroy();
-  delete this;
+  MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }
 
 void RenderWidgetHostViewGtk::SetTooltipText(const std::wstring& tooltip_text) {
diff --git a/chrome/common/owned_widget_gtk.cc b/chrome/common/owned_widget_gtk.cc
index 846cd1e..6b4f0d5 100644
--- a/chrome/common/owned_widget_gtk.cc
+++ b/chrome/common/owned_widget_gtk.cc
@@ -35,6 +35,6 @@ void OwnedWidgetGtk::Destroy() {
 
   DCHECK(!g_object_is_floating(widget));
   // NOTE: Assumes some implementation details about glib internals.
-  DCHECK(G_OBJECT(widget)->ref_count == 1);
+  DCHECK_EQ(G_OBJECT(widget)->ref_count, 1U);
   g_object_unref(widget);
 }