Attempt fix for crash bug when alert closes while owning host

is invalid.

I can't actually repro this bug, but I think this should fix it.

BUG=40439

Review URL: http://codereview.chromium.org/1540024

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@44125 0039d316-1c4b-4281-b951-d872f2087c98

5 files changed, 50 insertions, 31 deletions

diff --git a/chrome/browser/extensions/alert_apitest.cc b/chrome/browser/extensions/alert_apitest.cc
index 23e8fe8..7bb8448 100644
--- a/chrome/browser/extensions/alert_apitest.cc
+++ b/chrome/browser/extensions/alert_apitest.cc
@@ -7,6 +7,8 @@
 #include "chrome/browser/extensions/extension_apitest.h"
 #include "chrome/browser/extensions/extension_host.h"
 #include "chrome/browser/extensions/extension_process_manager.h"
+#include "chrome/browser/extensions/extensions_service.h"
+#include "chrome/browser/renderer_host/render_process_host.h"
 #include "chrome/browser/renderer_host/render_view_host.h"
 #include "chrome/browser/profile.h"
 #include "chrome/test/ui_test_utils.h"
@@ -18,10 +20,58 @@ IN_PROC_BROWSER_TEST_F(ExtensionApiTest, AlertBasic) {
   ExtensionHost* host = browser()->profile()->GetExtensionProcessManager()->
       GetBackgroundHostForExtension(extension);
   ASSERT_TRUE(host);
+
   host->render_view_host()->ExecuteJavascriptInWebFrame(L"",
       L"alert('This should not crash.');");
 
   AppModalDialog* alert = ui_test_utils::WaitForAppModalDialog();
   ASSERT_TRUE(alert);
+  ASSERT_TRUE(alert->IsValid());
+
   alert->CloseModalDialog();
 }
+
+// Test that we handle the case of an extension being unloaded while an alert is
+// up gracefully.
+IN_PROC_BROWSER_TEST_F(ExtensionApiTest, AlertOrphanedByUnload) {
+  ASSERT_TRUE(RunExtensionTest("alert")) << message_;
+
+  Extension* extension = GetSingleLoadedExtension();
+  ExtensionHost* host = browser()->profile()->GetExtensionProcessManager()->
+      GetBackgroundHostForExtension(extension);
+  ASSERT_TRUE(host);
+
+  host->render_view_host()->ExecuteJavascriptInWebFrame(L"",
+      L"alert('This should not crash.');");
+
+  AppModalDialog* alert = ui_test_utils::WaitForAppModalDialog();
+  ASSERT_TRUE(alert);
+
+  browser()->profile()->GetExtensionsService()->UnloadExtension(
+      extension->id());
+
+  ASSERT_FALSE(alert->IsValid());
+}
+
+// Test that we handle the case of an extension crashing while an alert is up
+// gracefully.
+IN_PROC_BROWSER_TEST_F(ExtensionApiTest, AlertOrphanedByCrash) {
+  ASSERT_TRUE(RunExtensionTest("alert")) << message_;
+
+  Extension* extension = GetSingleLoadedExtension();
+  ExtensionHost* host = browser()->profile()->GetExtensionProcessManager()->
+      GetBackgroundHostForExtension(extension);
+  ASSERT_TRUE(host);
+
+  host->render_view_host()->ExecuteJavascriptInWebFrame(L"",
+      L"alert('This should not crash.');");
+
+  AppModalDialog* alert = ui_test_utils::WaitForAppModalDialog();
+  ASSERT_TRUE(alert);
+
+  base::KillProcess(
+    browser()->profile()->GetExtensionProcessManager()->GetExtensionProcess(
+        extension->id())->GetHandle(),
+    base::PROCESS_END_KILLED_BY_USER,
+    true);  // Wait for process to exit.
+}
diff --git a/chrome/browser/js_modal_dialog.cc b/chrome/browser/js_modal_dialog.cc
index 5eb66a8..a66bece 100644
--- a/chrome/browser/js_modal_dialog.cc
+++ b/chrome/browser/js_modal_dialog.cc
@@ -100,27 +100,3 @@ void JavaScriptAppModalDialog::OnAccept(const std::wstring& prompt_text,
 
   Cleanup();
 }
-
-void JavaScriptAppModalDialog::OnClose() {
-  Cleanup();
-}
-
-void JavaScriptAppModalDialog::Cleanup() {
-  if (skip_this_dialog_) {
-    // We can't use the client_, because we might be in the process of
-    // destroying it.
-    if (tab_contents_)
-      tab_contents_->OnMessageBoxClosed(reply_msg_, false, L"");
-// The extension_host_ will always be a dirty pointer on OS X because the alert
-// window will cause the extension popup to close since it is resigning its key
-// state, destroying the host. http://crbug.com/29355
-#if !defined(OS_MACOSX)
-    else if (extension_host_)
-      extension_host_->OnMessageBoxClosed(reply_msg_, false, L"");
-    else
-      NOTREACHED();
-#endif
-  }
-  AppModalDialog::Cleanup();
-}
-
diff --git a/chrome/browser/js_modal_dialog.h b/chrome/browser/js_modal_dialog.h
index 65ed1ae..b53954e 100644
--- a/chrome/browser/js_modal_dialog.h
+++ b/chrome/browser/js_modal_dialog.h
@@ -71,11 +71,9 @@ class JavaScriptAppModalDialog : public AppModalDialog,
   // Callbacks from NativeDialog when the user accepts or cancels the dialog.
   void OnCancel();
   void OnAccept(const std::wstring& prompt_text, bool suppress_js_messages);
-  void OnClose();
 
  protected:
   // AppModalDialog overrides.
-  virtual void Cleanup();
   virtual NativeDialog CreateNativeDialog();
 
  private:
diff --git a/chrome/browser/views/jsmessage_box_dialog.cc b/chrome/browser/views/jsmessage_box_dialog.cc
index 269dde7..5a00605 100644
--- a/chrome/browser/views/jsmessage_box_dialog.cc
+++ b/chrome/browser/views/jsmessage_box_dialog.cc
@@ -77,10 +77,6 @@ bool JavaScriptMessageBoxDialog::Accept() {
   return true;
 }
 
-void JavaScriptMessageBoxDialog::OnClose() {
-  parent_->OnClose();
-}
-
 std::wstring JavaScriptMessageBoxDialog::GetDialogButtonLabel(
     MessageBoxFlags::DialogButton button) const {
   if (parent_->is_before_unload_dialog()) {
diff --git a/chrome/browser/views/jsmessage_box_dialog.h b/chrome/browser/views/jsmessage_box_dialog.h
index 62fcf51..42dc28e 100644
--- a/chrome/browser/views/jsmessage_box_dialog.h
+++ b/chrome/browser/views/jsmessage_box_dialog.h
@@ -42,7 +42,6 @@ class JavaScriptMessageBoxDialog : public ModalDialogDelegate {
   virtual bool IsModal() const { return true; }
   virtual views::View* GetContentsView();
   virtual views::View* GetInitiallyFocusedView();
-  virtual void OnClose();
 
  private:
   JavaScriptMessageBoxClient* client() {