Use a regular interface pointer for ITextDocument in AutocompleteEditViewWin.

I'm doing this because we want precise control over the lifetime of the validity of this pointer.

It turns out the paint patching code caused richedit20.dll to be unloaded, which caused the pointer held by the ScopedComPtr member to become junk and the subsequent ~ScopedComPtr to crash.

BUG=none
TEST=none

Review URL: http://codereview.chromium.org/340014

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@30429 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 25 insertions, 8 deletions

diff --git a/chrome/browser/autocomplete/autocomplete_edit_view_win.cc b/chrome/browser/autocomplete/autocomplete_edit_view_win.cc
index 32fb209..a03c1e4 100644
--- a/chrome/browser/autocomplete/autocomplete_edit_view_win.cc
+++ b/chrome/browser/autocomplete/autocomplete_edit_view_win.cc
@@ -403,7 +403,9 @@ AutocompleteEditViewWin::AutocompleteEditViewWin(
       initiated_drag_(false),
       drop_highlight_position_(-1),
       background_color_(0),
-      scheme_security_level_(ToolbarModel::NORMAL) {
+      scheme_security_level_(ToolbarModel::NORMAL),
+      text_object_model_(NULL),
+      riched20dll_handle_(LoadLibrary(L"riched20.dll")) {
   model_->SetPopupModel(popup_view_->GetModel());
 
   saved_selection_for_focus_change_.cpMin = -1;
@@ -467,6 +469,15 @@ AutocompleteEditViewWin::~AutocompleteEditViewWin() {
       Source<AutocompleteEditViewWin>(this),
       NotificationService::NoDetails());
 
+  // Explicitly release the text object model now that we're done with it, and
+  // before we free the library. If the library gets unloaded before this
+  // released, it becomes garbage.
+  text_object_model_->Release();
+
+  // We're now done with this library, so release our reference to it so it can
+  // be unloaded if possible.
+  FreeLibrary(riched20dll_handle_);
+
   // We balance our reference count and unpatch when the last instance has
   // been destroyed.  This prevents us from relying on the AtExit or static
   // destructor sequence to do our unpatching, which is generally fragile.
@@ -2241,8 +2252,11 @@ ITextDocument* AutocompleteEditViewWin::GetTextObjectModel() const {
     // constructor, in order to avoid hurting startup performance.
     ScopedComPtr<IRichEditOle, NULL> ole_interface;
     ole_interface.Attach(GetOleInterface());
-    if (ole_interface)
-      text_object_model_.QueryFrom(ole_interface);
+    if (ole_interface) {
+      ole_interface.QueryInterface(
+          __uuidof(ITextDocument),
+          reinterpret_cast<void**>(&text_object_model_));
+    }
   }
   return text_object_model_;
 }
diff --git a/chrome/browser/autocomplete/autocomplete_edit_view_win.h b/chrome/browser/autocomplete/autocomplete_edit_view_win.h
index 8946c4c..0d20df0 100644
--- a/chrome/browser/autocomplete/autocomplete_edit_view_win.h
+++ b/chrome/browser/autocomplete/autocomplete_edit_view_win.h
@@ -342,10 +342,9 @@ class AutocompleteEditViewWin
   // Determines whether the user can "paste and go", given the specified text.
   bool CanPasteAndGo(const std::wstring& text) const;
 
-  // Getter for the text_object_model_, used by the ScopedXXX classes.  Note
-  // that the pointer returned here is only valid as long as the
-  // AutocompleteEdit is still alive.  Also, if the underlying call fails, this
-  // may return NULL.
+  // Getter for the text_object_model_.  Note that the pointer returned here is
+  // only valid as long as the AutocompleteEdit is still alive.  Also, if the
+  // underlying call fails, this may return NULL.
   ITextDocument* GetTextObjectModel() const;
 
   // Invoked during a mouse move. As necessary starts a drag and drop session.
@@ -477,7 +476,7 @@ class AutocompleteEditViewWin
   ToolbarModel::SecurityLevel scheme_security_level_;
 
   // This interface is useful for accessing the CRichEditCtrl at a low level.
-  mutable ScopedComPtr<ITextDocument> text_object_model_;
+  mutable ITextDocument* text_object_model_;
 
   // This contains the scheme char start and stop indexes that should be
   // striken-out when displaying an insecure scheme.
@@ -486,6 +485,10 @@ class AutocompleteEditViewWin
   // Instance of accessibility information and handling.
   mutable ScopedComPtr<IAccessible> autocomplete_accessibility_;
 
+  // We explicitly retain a handle to this library so it never gets unloaded out
+  // from underneath us.
+  HMODULE riched20dll_handle_;
+
   DISALLOW_COPY_AND_ASSIGN(AutocompleteEditViewWin);
 };