Revert 44407 - Fix freedmemoryread (and maybe writes later?) due to accessing members of a destroyed object while unwinding the callstack.

BUG=41274
TEST=Run Chrome with full page heap on.  Clicking an item in the omnibox dropdown should not crash.
Review URL: http://codereview.chromium.org/1566040

TBR=pkasting@chromium.org
Review URL: http://codereview.chromium.org/1589033

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@44421 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 14 insertions, 24 deletions

diff --git a/chrome/browser/views/autocomplete/autocomplete_popup_contents_view.cc b/chrome/browser/views/autocomplete/autocomplete_popup_contents_view.cc
index 8cdb7cd..7f974a8 100644
--- a/chrome/browser/views/autocomplete/autocomplete_popup_contents_view.cc
+++ b/chrome/browser/views/autocomplete/autocomplete_popup_contents_view.cc
@@ -504,8 +504,7 @@ AutocompletePopupContentsView::AutocompletePopupContentsView(
     AutocompleteEditModel* edit_model,
     Profile* profile,
     const views::View* location_bar)
-    : popup_(NULL),
-      model_(new AutocompletePopupModel(this, edit_model, profile)),
+    : model_(new AutocompletePopupModel(this, edit_model, profile)),
       edit_view_(edit_view),
       location_bar_(location_bar),
       result_font_(font.DeriveFont(kEditFontAdjust)),
@@ -518,13 +517,6 @@ AutocompletePopupContentsView::AutocompletePopupContentsView(
   set_border(bubble_border);
 }
 
-AutocompletePopupContentsView::~AutocompletePopupContentsView() {
-  // Don't do anything with |popup_| here.  The OS will close the window, which
-  // will trigger its deletion.  If that has already happened by the time we
-  // reach here, |popup_| points at garbage; otherwise, closing is unnecessary.
-  // So either way, we shouldn't do anything.
-}
-
 gfx::Rect AutocompletePopupContentsView::GetPopupBounds() const {
   if (!size_animation_.IsAnimating())
     return target_bounds_;
@@ -557,12 +549,8 @@ void AutocompletePopupContentsView::UpdatePopupAppearance() {
     // No matches, close any existing popup.
     if (popup_ != NULL) {
       size_animation_.Stop();
-      // NOTE: Do NOT use CloseNow() here, as we may be deep in a callstack
-      // triggered by the popup receiving a message (e.g. LBUTTONUP), and
-      // destroying the popup would cause us to read garbage when we unwind back
-      // to that level.
-      popup_->Close();  // This will eventually delete the popup.
-      popup_ = NULL;
+      popup_->CloseNow();
+      popup_.reset();
     }
     return;
   }
@@ -602,7 +590,7 @@ void AutocompletePopupContentsView::UpdatePopupAppearance() {
 
   if (popup_ == NULL) {
     // If the popup is currently closed, we need to create it.
-    popup_ = new AutocompletePopupClass(edit_view_, this);
+    popup_.reset(new AutocompletePopupClass(edit_view_, this));
   } else {
     // Animate the popup shrinking, but don't animate growing larger since that
     // would make the popup feel less responsive.
diff --git a/chrome/browser/views/autocomplete/autocomplete_popup_contents_view.h b/chrome/browser/views/autocomplete/autocomplete_popup_contents_view.h
index fb53f44..31237c4 100644
--- a/chrome/browser/views/autocomplete/autocomplete_popup_contents_view.h
+++ b/chrome/browser/views/autocomplete/autocomplete_popup_contents_view.h
@@ -46,7 +46,7 @@ class AutocompletePopupContentsView : public views::View,
                                 AutocompleteEditModel* edit_model,
                                 Profile* profile,
                                 const views::View* location_bar);
-  virtual ~AutocompletePopupContentsView();
+  virtual ~AutocompletePopupContentsView() {}
 
   // Returns the bounds the popup should be shown at. This is the display bounds
   // and includes offsets for the dropshadow which this view's border renders.
@@ -113,8 +113,8 @@ class AutocompletePopupContentsView : public views::View,
   // match at the specified point.
   size_t GetIndexForPoint(const gfx::Point& point);
 
-  // The popup that contains this view.  We own this pointer.
-  AutocompletePopupClass* popup_;
+  // The popup that contains this view.
+  scoped_ptr<AutocompletePopupClass> popup_;
 
   // The provider of our result set.
   scoped_ptr<AutocompletePopupModel> model_;
diff --git a/chrome/browser/views/autocomplete/autocomplete_popup_gtk.cc b/chrome/browser/views/autocomplete/autocomplete_popup_gtk.cc
index 4bb7f09..b0bf07b 100644
--- a/chrome/browser/views/autocomplete/autocomplete_popup_gtk.cc
+++ b/chrome/browser/views/autocomplete/autocomplete_popup_gtk.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -17,7 +17,8 @@ AutocompletePopupGtk::AutocompletePopupGtk(
     AutocompleteEditView* edit_view,
     AutocompletePopupContentsView* contents)
     : WidgetGtk(WidgetGtk::TYPE_POPUP) {
-  // Create the popup.
+  // Create the popup.  // Owned by |contents|.
+  set_delete_on_destroy(false);
   MakeTransparent();
   WidgetGtk::Init(gtk_widget_get_parent(edit_view->GetNativeView()),
                   contents->GetPopupBounds());
diff --git a/chrome/browser/views/autocomplete/autocomplete_popup_win.cc b/chrome/browser/views/autocomplete/autocomplete_popup_win.cc
index 4cb7ddc..35231fe 100644
--- a/chrome/browser/views/autocomplete/autocomplete_popup_win.cc
+++ b/chrome/browser/views/autocomplete/autocomplete_popup_win.cc
@@ -1,6 +1,6 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
+// Copyright (c) 2009 The Chromium Authors. All rights reserved. Use of this
+// source code is governed by a BSD-style license that can be found in the
+// LICENSE file.
 
 #include "chrome/browser/views/autocomplete/autocomplete_popup_win.h"
 
@@ -17,6 +17,7 @@ AutocompletePopupWin::AutocompletePopupWin(
     AutocompleteEditView* edit_view,
     AutocompletePopupContentsView* contents) {
   // Create the popup.
+  set_delete_on_destroy(false);  // Owned by |contents|.
   set_window_style(WS_POPUP | WS_CLIPCHILDREN);
   set_window_ex_style(WS_EX_TOOLWINDOW | WS_EX_LAYERED);
   WidgetWin::Init(GetAncestor(edit_view->GetNativeView(), GA_ROOT),