Fix a bug where we would cache the incognito profile pointer in

DOMUIThemeSource and try to use it after it was deleted.
Instead, always cache the original profile pointer (which will
live longer).

While I'm here, get rid of the profile_ cached in
NewTabHTMLSource because we don't need it after the ctor is done
running.

BUG=26840

Review URL: http://codereview.chromium.org/372072

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@31513 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 24 insertions, 27 deletions

diff --git a/chrome/browser/dom_ui/dom_ui_theme_source.cc b/chrome/browser/dom_ui/dom_ui_theme_source.cc
index 8361198..e447c3e 100644
--- a/chrome/browser/dom_ui/dom_ui_theme_source.cc
+++ b/chrome/browser/dom_ui/dom_ui_theme_source.cc
@@ -52,11 +52,11 @@ static std::string StripQueryParams(const std::string& path) {
 
 DOMUIThemeSource::DOMUIThemeSource(Profile* profile)
     : DataSource(chrome::kChromeUIThemePath, MessageLoop::current()),
-      profile_(profile) {
+      profile_(profile->GetOriginalProfile()) {
   if (profile->IsOffTheRecord())
-    InitNewIncognitoTabCSS();
+    InitNewIncognitoTabCSS(profile);
   else
-    InitNewTabCSS();
+    InitNewTabCSS(profile);
 }
 
 void DOMUIThemeSource::StartDataRequest(const std::string& path,
@@ -116,8 +116,8 @@ MessageLoop* DOMUIThemeSource::MessageLoopForRequestPath(
 ////////////////////////////////////////////////////////////////////////////////
 // DOMUIThemeSource, private:
 
-void DOMUIThemeSource::InitNewTabCSS() {
-  ThemeProvider* tp = profile_->GetThemeProvider();
+void DOMUIThemeSource::InitNewTabCSS(Profile* profile) {
+  ThemeProvider* tp = profile->GetThemeProvider();
   DCHECK(tp);
 
   // Get our theme colors
@@ -163,7 +163,7 @@ void DOMUIThemeSource::InitNewTabCSS() {
 
   // Cache-buster for background.
   subst.push_back(WideToASCII(
-      profile_->GetPrefs()->GetString(prefs::kCurrentThemeID)));  // $1
+      profile->GetPrefs()->GetString(prefs::kCurrentThemeID)));  // $1
 
   // Colors.
   subst.push_back(SkColorToRGBAString(color_background));  // $2
@@ -184,7 +184,7 @@ void DOMUIThemeSource::InitNewTabCSS() {
   subst2.push_back(SkColorToRGBAString(color_link_underline));  // $$6
   subst2.push_back(SkColorToRGBAString(color_section_link_underline));  // $$7
 
-  if (profile_->GetPrefs()->GetInteger(prefs::kNTPThemePromoRemaining) > 0)
+  if (profile->GetPrefs()->GetInteger(prefs::kNTPThemePromoRemaining) > 0)
     subst2.push_back("block");  // $$8
   else
     subst2.push_back("none");  // $$8
@@ -201,8 +201,8 @@ void DOMUIThemeSource::InitNewTabCSS() {
       css_string, subst2, NULL);
 }
 
-void DOMUIThemeSource::InitNewIncognitoTabCSS() {
-  ThemeProvider* tp = profile_->GetThemeProvider();
+void DOMUIThemeSource::InitNewIncognitoTabCSS(Profile* profile) {
+  ThemeProvider* tp = profile->GetThemeProvider();
   DCHECK(tp);
 
   // Get our theme colors
@@ -214,7 +214,7 @@ void DOMUIThemeSource::InitNewIncognitoTabCSS() {
 
   // Cache-buster for background.
   subst.push_back(WideToUTF8(
-      profile_->GetPrefs()->GetString(prefs::kCurrentThemeID)));  // $1
+      profile->GetPrefs()->GetString(prefs::kCurrentThemeID)));  // $1
 
   // Colors.
   subst.push_back(SkColorToRGBAString(color_background));  // $2
diff --git a/chrome/browser/dom_ui/dom_ui_theme_source.h b/chrome/browser/dom_ui/dom_ui_theme_source.h
index f20d104..c72727d 100644
--- a/chrome/browser/dom_ui/dom_ui_theme_source.h
+++ b/chrome/browser/dom_ui/dom_ui_theme_source.h
@@ -36,8 +36,8 @@ class DOMUIThemeSource : public ChromeURLDataManager::DataSource {
   // A new DOMUIThemeSource object is used for each new tab page instance
   // and each reload of an existing new tab page, so there is no concern about
   // cached data becoming stale.
-  void InitNewTabCSS();
-  void InitNewIncognitoTabCSS();
+  void InitNewTabCSS(Profile* profile);
+  void InitNewIncognitoTabCSS(Profile* profile);
 
   // Send the CSS for the new tab or the new incognito tab.
   void SendNewTabCSS(int request_id, const std::string& css_string);
@@ -58,6 +58,7 @@ class DOMUIThemeSource : public ChromeURLDataManager::DataSource {
   std::string new_tab_css_;
   std::string new_incognito_tab_css_;
 
+  // The original profile (never an OTR profile).
   Profile* profile_;
   DISALLOW_COPY_AND_ASSIGN(DOMUIThemeSource);
 };
diff --git a/chrome/browser/dom_ui/new_tab_ui.cc b/chrome/browser/dom_ui/new_tab_ui.cc
index 9dd8dc84..87181f0 100644
--- a/chrome/browser/dom_ui/new_tab_ui.cc
+++ b/chrome/browser/dom_ui/new_tab_ui.cc
@@ -737,9 +737,8 @@ bool NewTabUI::NewTabHTMLSource::first_view_ = true;
 bool NewTabUI::NewTabHTMLSource::first_run_ = true;
 
 NewTabUI::NewTabHTMLSource::NewTabHTMLSource(Profile* profile)
-    : DataSource(chrome::kChromeUINewTabHost, MessageLoop::current()),
-      profile_(profile) {
-  InitFullHTML();
+    : DataSource(chrome::kChromeUINewTabHost, MessageLoop::current()) {
+  InitFullHTML(profile);
 }
 
 void NewTabUI::NewTabHTMLSource::StartDataRequest(const std::string& path,
@@ -784,7 +783,7 @@ std::string NewTabUI::NewTabHTMLSource::GetCustomNewTabPageFromCommandLine() {
   return std::string();
 }
 
-void NewTabUI::NewTabHTMLSource::InitFullHTML() {
+void NewTabUI::NewTabHTMLSource::InitFullHTML(Profile* profile) {
   // Show the profile name in the title and most visited labels if the current
   // profile is not the default.
   std::wstring title;
@@ -804,10 +803,10 @@ void NewTabUI::NewTabHTMLSource::InitFullHTML() {
   }
   DictionaryValue localized_strings;
   localized_strings.SetString(L"bookmarkbarattached",
-      profile_->GetPrefs()->GetBoolean(prefs::kShowBookmarkBar) ?
+      profile->GetPrefs()->GetBoolean(prefs::kShowBookmarkBar) ?
       "true" : "false");
   localized_strings.SetString(L"hasattribution",
-      profile_->GetThemeProvider()->HasCustomImage(IDR_THEME_NTP_ATTRIBUTION) ?
+      profile->GetThemeProvider()->HasCustomImage(IDR_THEME_NTP_ATTRIBUTION) ?
       "true" : "false");
   localized_strings.SetString(L"title", title);
   localized_strings.SetString(L"mostvisited", most_visited);
@@ -891,12 +890,12 @@ void NewTabUI::NewTabHTMLSource::InitFullHTML() {
 
   // Don't initiate the sync related message passing with the page if the sync
   // code is not present.
-  if (profile_->GetProfileSyncService())
+  if (profile->GetProfileSyncService())
     localized_strings.SetString(L"syncispresent", "true");
   else
     localized_strings.SetString(L"syncispresent", "false");
 
-  if (!profile_->GetPrefs()->GetBoolean(prefs::kHomePageIsNewTabPage))
+  if (!profile->GetPrefs()->GetBoolean(prefs::kHomePageIsNewTabPage))
     localized_strings.SetString(L"showsetashomepage", "true");
 
   SetFontAndTextDirection(&localized_strings);
@@ -907,8 +906,8 @@ void NewTabUI::NewTabHTMLSource::InitFullHTML() {
 
     // Decrement ntp promo counter; the default value is specified in
     // Browser::RegisterUserPrefs.
-    profile_->GetPrefs()->SetInteger(prefs::kNTPThemePromoRemaining,
-        profile_->GetPrefs()->GetInteger(prefs::kNTPThemePromoRemaining) - 1);
+    profile->GetPrefs()->SetInteger(prefs::kNTPThemePromoRemaining,
+        profile->GetPrefs()->GetInteger(prefs::kNTPThemePromoRemaining) - 1);
     first_view_ = false;
   }
 
@@ -918,7 +917,7 @@ void NewTabUI::NewTabHTMLSource::InitFullHTML() {
   localized_strings.SetString(L"anim", anim);
 
   // Pass the shown_sections pref early so that we can prevent flicker.
-  const int shown_sections = profile_->GetPrefs()->GetInteger(
+  const int shown_sections = profile->GetPrefs()->GetInteger(
       prefs::kNTPShownSections);
   localized_strings.SetInteger(L"shown_sections", shown_sections);
 
diff --git a/chrome/browser/dom_ui/new_tab_ui.h b/chrome/browser/dom_ui/new_tab_ui.h
index 1feac2a..f7f0349 100644
--- a/chrome/browser/dom_ui/new_tab_ui.h
+++ b/chrome/browser/dom_ui/new_tab_ui.h
@@ -91,7 +91,7 @@ class NewTabUI : public DOMUI,
     // A new NewTabHTMLSource object is used for each new tab page instance
     // and each reload of an existing new tab page, so there is no concern
     // about cached data becoming stale.
-    void InitFullHTML();
+    void InitFullHTML(Profile* profile);
 
     // The content to be served by StartDataRequest, stored by InitFullHTML.
     std::string full_html_;
@@ -103,9 +103,6 @@ class NewTabUI : public DOMUI,
     // Whether this is the first run.
     static bool first_run_;
 
-    // The user's profile.
-    Profile* profile_;
-
     DISALLOW_COPY_AND_ASSIGN(NewTabHTMLSource);
   };