Speculatve fix for a chrome crash caused in a chrome frame instance while processing an automation message

to focus through an external tab. Based on the crash dump, it appears that the tab_contents_ member is destroyed
and set to NULL in the context of a call to TabContents::Focus which calls the Windows API SetFocus on the native
HWND, which could dispatch messages like WM_DESTROY for the external tab.

Fix is to add a second NULL check for tab_contents_ after the call to TabContents::Focus. Added a comment
describing this scenario in the code.

Fixes bug http://code.google.com/p/chromium/issues/detail?id=29246

Bug=29246

Review URL: http://codereview.chromium.org/653005

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@39757 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 9 insertions, 4 deletions

diff --git a/chrome/browser/external_tab_container.cc b/chrome/browser/external_tab_container.cc
index 55e8846..842341b 100644
--- a/chrome/browser/external_tab_container.cc
+++ b/chrome/browser/external_tab_container.cc
@@ -237,10 +237,15 @@ void ExternalTabContainer::ProcessUnhandledAccelerator(const MSG& msg) {
 
 void ExternalTabContainer::FocusThroughTabTraversal(bool reverse) {
   DCHECK(tab_contents_);
-  if (tab_contents_) {
-    static_cast<TabContents*>(tab_contents_)->Focus();
-    static_cast<TabContents*>(tab_contents_)->FocusThroughTabTraversal(reverse);
-  }
+  if (tab_contents_)
+    tab_contents_->Focus();
+
+  // The tab_contents_ member can get destroyed in the context of the call to
+  // TabContentsViewWin::Focus() above. This method eventually calls SetFocus
+  // on the native window, which could end up dispatching messages like
+  // WM_DESTROY for the external tab.
+  if (tab_contents_)
+    tab_contents_->FocusThroughTabTraversal(reverse);
 }
 
 // static