Resolve issue 22731

The RenderViewHost for the TabContents of a DraggedGtkTab was changing,
and the dragged tab was using the backing store associated with the invalidated
RenderViewHost.

BUG=22731
TEST=See issue description

Patch from Garret Kelly <gdk@chromium.org>
Review URL: http://codereview.chromium.org/550002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@35933 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 12 insertions, 21 deletions

diff --git a/chrome/browser/gtk/tabs/dragged_tab_controller_gtk.cc b/chrome/browser/gtk/tabs/dragged_tab_controller_gtk.cc
index 2bc7772..65fa966 100644
--- a/chrome/browser/gtk/tabs/dragged_tab_controller_gtk.cc
+++ b/chrome/browser/gtk/tabs/dragged_tab_controller_gtk.cc
@@ -563,9 +563,7 @@ void DraggedTabControllerGtk::Detach() {
   // conditions during automation where the view_ is destroyed inside a
   // function call preceding this point but after it is created.
   if (dragged_tab_.get()) {
-    RenderViewHost* host = dragged_contents_->render_view_host();
-    dragged_tab_->Detach(dragged_contents_->GetContentNativeView(),
-                         host->GetBackingStore(false));
+    dragged_tab_->Detach();
   }
 
   // Detaching resets the delegate, but we still want to be the delegate.
diff --git a/chrome/browser/gtk/tabs/dragged_tab_gtk.cc b/chrome/browser/gtk/tabs/dragged_tab_gtk.cc
index 12e9639..fce118d 100644
--- a/chrome/browser/gtk/tabs/dragged_tab_gtk.cc
+++ b/chrome/browser/gtk/tabs/dragged_tab_gtk.cc
@@ -13,6 +13,7 @@
 #include "app/l10n_util.h"
 #include "chrome/browser/browser_theme_provider.h"
 #include "chrome/browser/profile.h"
+#include "chrome/browser/renderer_host/backing_store.h"
 #include "chrome/browser/tab_contents/tab_contents.h"
 #include "chrome/browser/tabs/tab_strip_model.h"
 #include "chrome/browser/gtk/tabs/tab_renderer_gtk.h"
@@ -45,7 +46,7 @@ const double kDraggedTabBorderColor[] = { 103.0 / 0xff,
 DraggedTabGtk::DraggedTabGtk(TabContents* datasource,
                              const gfx::Point& mouse_tab_offset,
                              const gfx::Size& contents_size)
-    : backing_store_(NULL),
+    : data_source_(datasource),
       renderer_(new TabRendererGtk(datasource->profile()->GetThemeProvider())),
       attached_(false),
       mouse_tab_offset_(mouse_tab_offset),
@@ -105,7 +106,7 @@ bool DraggedTabGtk::is_pinned() const {
   return renderer_->is_pinned();
 }
 
-void DraggedTabGtk::Detach(GtkWidget* contents, BackingStore* backing_store) {
+void DraggedTabGtk::Detach() {
   // Detached tabs are never pinned.
   renderer_->set_pinned(false);
 
@@ -115,8 +116,6 @@ void DraggedTabGtk::Detach(GtkWidget* contents, BackingStore* backing_store) {
   }
 
   attached_ = false;
-  contents_ = contents;
-  backing_store_ = backing_store;
   ResizeContainer();
 
   if (gtk_util::IsScreenComposited())
@@ -298,9 +297,11 @@ gboolean DraggedTabGtk::OnExposeEvent(GtkWidget* widget,
       dragged_tab->renderer_->height());
 
   // Draw the render area.
-  if (dragged_tab->backing_store_ && !dragged_tab->attached_) {
+  BackingStore* backing_store =
+      dragged_tab->data_source_->render_view_host()->GetBackingStore(false);
+  if (backing_store && !dragged_tab->attached_) {
     // This leaves room for the border.
-    dragged_tab->backing_store_->PaintToRect(
+    backing_store->PaintToRect(
         gfx::Rect(kDragFrameBorderSize, tab_height,
                   widget->allocation.width - kTwiceDragFrameBorderSize,
                   widget->allocation.height - tab_height -
diff --git a/chrome/browser/gtk/tabs/dragged_tab_gtk.h b/chrome/browser/gtk/tabs/dragged_tab_gtk.h
index 839ce6b..4ec77bf 100644
--- a/chrome/browser/gtk/tabs/dragged_tab_gtk.h
+++ b/chrome/browser/gtk/tabs/dragged_tab_gtk.h
@@ -14,7 +14,6 @@
 #include "base/gfx/size.h"
 #include "base/scoped_ptr.h"
 #include "base/task.h"
-#include "chrome/browser/renderer_host/backing_store.h"
 
 class TabContents;
 class TabRendererGtk;
@@ -53,10 +52,7 @@ class DraggedTabGtk : public AnimationDelegate {
   bool is_pinned() const;
 
   // Notifies the dragged tab that it has been detached from a tabstrip.
-  // |contents| is the widget that contains the dragged tab contents, while
-  // |backing_store| is the backing store that holds a server-side bitmap of the
-  // visual representation of |contents|.
-  void Detach(GtkWidget* contents, BackingStore* backing_store);
+  void Detach();
 
   // Notifies the dragged tab that it should update itself.
   void Update();
@@ -112,6 +108,9 @@ class DraggedTabGtk : public AnimationDelegate {
   static gboolean OnExposeEvent(GtkWidget* widget, GdkEventExpose* event,
                                 DraggedTabGtk* dragged_tab);
 
+  // The tab contents that the dragged tab contains.
+  TabContents* data_source_;
+
   // The window that contains the dragged tab or tab contents.
   GtkWidget* container_;
 
@@ -119,13 +118,6 @@ class DraggedTabGtk : public AnimationDelegate {
   // tab widget won't be resized.
   GtkWidget* fixed_;
 
-  // The native view of the tab contents.
-  GtkWidget* contents_;
-
-  // The backing store used to create a screenshot of the dragged contents.
-  // Owned by the RWH.
-  BackingStore* backing_store_;
-
   // The renderer that paints the dragged tab.
   scoped_ptr<TabRendererGtk> renderer_;