Attempt at fixing crash in WebContents::ShowWidget. I suspect this is

happening because the RenderWidgetHost is getting destroyed between
the time it is created but before it it shown (perhaps the renderer
went away).

BUG=4629
TEST=none

Review URL: http://codereview.chromium.org/12439

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@5998 0039d316-1c4b-4281-b951-d872f2087c98

5 files changed, 34 insertions, 0 deletions

diff --git a/chrome/browser/render_widget_host.cc b/chrome/browser/render_widget_host.cc
index 7374c92..41fd233 100644
--- a/chrome/browser/render_widget_host.cc
+++ b/chrome/browser/render_widget_host.cc
@@ -667,6 +667,11 @@ void RenderWidgetHost::ViewDestroyed() {
 }
 
 void RenderWidgetHost::Destroy() {
+  NotificationService::current()->Notify(
+      NOTIFY_RENDER_WIDGET_HOST_DESTROYED,
+      Source<RenderWidgetHost>(this),
+      NotificationService::NoDetails());
+
   // Tell the view to die.
   // Note that in the process of the view shutting down, it can call a ton
   // of other messages on us.  So if you do any other deinitialization here,
diff --git a/chrome/browser/web_contents.cc b/chrome/browser/web_contents.cc
index c3c0a9e..0c0b34d 100644
--- a/chrome/browser/web_contents.cc
+++ b/chrome/browser/web_contents.cc
@@ -213,6 +213,9 @@ WebContents::WebContents(Profile* profile,
   NotificationService::current()->
       AddObserver(this, NOTIFY_BOOKMARK_MODEL_LOADED,
                   NotificationService::AllSources());
+  NotificationService::current()->
+      AddObserver(this, NOTIFY_RENDER_WIDGET_HOST_DESTROYED,
+                  NotificationService::AllSources());
 }
 
 WebContents::~WebContents() {
@@ -220,6 +223,9 @@ WebContents::~WebContents() {
     web_app_->RemoveObserver(this);
   if (pending_install_.callback_functor)
     pending_install_.callback_functor->Cancel();
+  NotificationService::current()->
+      RemoveObserver(this, NOTIFY_RENDER_WIDGET_HOST_DESTROYED,
+                     NotificationService::AllSources());
 }
 
 // static
@@ -1475,6 +1481,9 @@ void WebContents::Observe(NotificationType type,
       }
       break;
     }
+    case NOTIFY_RENDER_WIDGET_HOST_DESTROYED:
+      view_->RenderWidgetHostDestroyed(Source<RenderWidgetHost>(source).ptr());
+      break;
     default: {
       TabContents::Observe(type, source, details);
       break;
diff --git a/chrome/browser/web_contents_view.cc b/chrome/browser/web_contents_view.cc
index 931e36c..6675474 100644
--- a/chrome/browser/web_contents_view.cc
+++ b/chrome/browser/web_contents_view.cc
@@ -4,6 +4,18 @@
 
 #include "chrome/browser/web_contents_view.h"
 
+#include "chrome/browser/render_widget_host.h"
+
+void WebContentsView::RenderWidgetHostDestroyed(RenderWidgetHost* host) {
+  for (PendingWidgetViews::iterator i = pending_widget_views_.begin();
+       i != pending_widget_views_.end(); ++i) {
+    if (host->view() == i->second) {
+      pending_widget_views_.erase(i);
+      return;
+    }
+  }
+}
+
 void WebContentsView::CreateNewWindow(int route_id, HANDLE modal_dialog_event) {
   // Save the created window associated with the route so we can show it later.
   pending_contents_[route_id] = CreateNewWindowInternal(route_id,
diff --git a/chrome/browser/web_contents_view.h b/chrome/browser/web_contents_view.h
index c253a7d..c197c00 100644
--- a/chrome/browser/web_contents_view.h
+++ b/chrome/browser/web_contents_view.h
@@ -118,6 +118,10 @@ class WebContentsView : public RenderViewHostDelegate::View {
   // TabContents without the special code.
   virtual void SizeContents(const gfx::Size& size) = 0;
 
+  // Invoked from the platform dependent web contents view when a
+  // RenderWidgetHost is deleted. Removes |host| from internal maps.
+  void RenderWidgetHostDestroyed(RenderWidgetHost* host);
+
   // Find in page --------------------------------------------------------------
 
   // Opens the find in page window if it isn't already open. It will advance to
diff --git a/chrome/common/notification_types.h b/chrome/common/notification_types.h
index d6ca458..0e550a2 100644
--- a/chrome/common/notification_types.h
+++ b/chrome/common/notification_types.h
@@ -269,6 +269,10 @@ enum NotificationType {
   // RenderViewHost is set).
   NOTIFY_RENDER_VIEW_HOST_CHANGED,
 
+  // This is sent when a RenderWidgetHost is being destroyed. The source
+  // is the RenderWidgetHost, the details are not used.
+  NOTIFY_RENDER_WIDGET_HOST_DESTROYED,
+
   // Notification from WebContents that we have received a response from
   // the renderer after using the dom inspector.
   NOTIFY_DOM_INSPECT_ELEMENT_RESPONSE,