Back out r132850 from the trunk. It caused crashes, documented at bug 124208.

TBR=koz
BUG=121479, 124208
TEST=Browse around for a few minutes with an extension such as
     cfhdojbkjhnklbpkdaibdccddilifddb. Expect no sad tabs.
Review URL: https://chromiumcodereview.appspot.com/10171011

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@133253 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 97 insertions, 91 deletions

diff --git a/chrome/renderer/extensions/event_bindings.cc b/chrome/renderer/extensions/event_bindings.cc
index 5a21064..478c7f2 100644
--- a/chrome/renderer/extensions/event_bindings.cc
+++ b/chrome/renderer/extensions/event_bindings.cc
@@ -15,6 +15,7 @@
 #include "chrome/common/url_constants.h"
 #include "chrome/renderer/extensions/chrome_v8_context.h"
 #include "chrome/renderer/extensions/chrome_v8_context_set.h"
+#include "chrome/renderer/extensions/chrome_v8_extension.h"
 #include "chrome/renderer/extensions/event_bindings.h"
 #include "chrome/renderer/extensions/extension_dispatcher.h"
 #include "chrome/renderer/extensions/extension_helper.h"
@@ -46,94 +47,108 @@ typedef std::map<std::string, int> EventListenerCounts;
 base::LazyInstance<std::map<std::string, EventListenerCounts> >
     g_listener_counts = LAZY_INSTANCE_INITIALIZER;
 
-}  // namespace
-
-EventBindings::EventBindings(ExtensionDispatcher* dispatcher)
-    : ChromeV8Extension(dispatcher) {
-  RouteFunction("AttachEvent", base::Bind(&EventBindings::AttachEvent,
-                                          base::Unretained(this)));
-  RouteFunction("DetachEvent", base::Bind(&EventBindings::DetachEvent,
-                                          base::Unretained(this)));
-}
+// TODO(koz): Merge this into EventBindings.
+class ExtensionImpl : public ChromeV8Extension {
+ public:
 
-v8::Handle<v8::Value> EventBindings::AttachEvent(const v8::Arguments& args) {
-  DCHECK(args.Length() == 1);
-  // TODO(erikkay) should enforce that event name is a string in the bindings
-  DCHECK(args[0]->IsString() || args[0]->IsUndefined());
-
-  if (args[0]->IsString()) {
-    const ChromeV8ContextSet& context_set =
-        extension_dispatcher()->v8_context_set();
-    ChromeV8Context* context = context_set.GetCurrent();
-    CHECK(context);
-    std::string event_name(*v8::String::AsciiValue(args[0]));
-
-    if (!extension_dispatcher()->CheckCurrentContextAccessToExtensionAPI(
-            event_name))
-      return v8::Undefined();
-
-    std::string extension_id = context->GetExtensionID();
-    EventListenerCounts& listener_counts =
-        g_listener_counts.Get()[extension_id];
-    if (++listener_counts[event_name] == 1) {
-      content::RenderThread::Get()->Send(
-          new ExtensionHostMsg_AddListener(extension_id, event_name));
+  explicit ExtensionImpl(ExtensionDispatcher* dispatcher)
+      : ChromeV8Extension(dispatcher) {
+    RouteStaticFunction("AttachEvent", &AttachEvent);
+    RouteStaticFunction("DetachEvent", &DetachEvent);
+  }
+  ~ExtensionImpl() {}
+
+  // Attach an event name to an object.
+  static v8::Handle<v8::Value> AttachEvent(const v8::Arguments& args) {
+    DCHECK(args.Length() == 1);
+    // TODO(erikkay) should enforce that event name is a string in the bindings
+    DCHECK(args[0]->IsString() || args[0]->IsUndefined());
+
+    if (args[0]->IsString()) {
+      ExtensionImpl* self = GetFromArguments<ExtensionImpl>(args);
+      const ChromeV8ContextSet& context_set =
+          self->extension_dispatcher()->v8_context_set();
+      ChromeV8Context* context = context_set.GetCurrent();
+      CHECK(context);
+      std::string event_name(*v8::String::AsciiValue(args[0]));
+
+      ExtensionDispatcher* extension_dispatcher = self->extension_dispatcher();
+      if (!extension_dispatcher->CheckCurrentContextAccessToExtensionAPI(
+              event_name))
+        return v8::Undefined();
+
+      std::string extension_id = context->GetExtensionID();
+      EventListenerCounts& listener_counts =
+          g_listener_counts.Get()[extension_id];
+      if (++listener_counts[event_name] == 1) {
+        content::RenderThread::Get()->Send(
+            new ExtensionHostMsg_AddListener(extension_id, event_name));
+      }
+
+      // This is called the first time the page has added a listener. Since
+      // the background page is the only lazy page, we know this is the first
+      // time this listener has been registered.
+      if (self->IsLazyBackgroundPage(context->extension())) {
+        content::RenderThread::Get()->Send(
+            new ExtensionHostMsg_AddLazyListener(extension_id, event_name));
+      }
     }
 
-    // This is called the first time the page has added a listener. Since
-    // the background page is the only lazy page, we know this is the first
-    // time this listener has been registered.
-    if (IsLazyBackgroundPage(context->extension())) {
-      content::RenderThread::Get()->Send(
-          new ExtensionHostMsg_AddLazyListener(extension_id, event_name));
-    }
+    return v8::Undefined();
   }
 
-  return v8::Undefined();
-}
-
-v8::Handle<v8::Value> EventBindings::DetachEvent(const v8::Arguments& args) {
-  DCHECK(args.Length() == 2);
-  // TODO(erikkay) should enforce that event name is a string in the bindings
-  DCHECK(args[0]->IsString() || args[0]->IsUndefined());
-
-  if (args[0]->IsString() && args[1]->IsBoolean()) {
-    const ChromeV8ContextSet& context_set =
-        extension_dispatcher()->v8_context_set();
-    ChromeV8Context* context = context_set.GetCurrent();
-    if (!context)
-      return v8::Undefined();
-
-    std::string extension_id = context->GetExtensionID();
-    EventListenerCounts& listener_counts =
-        g_listener_counts.Get()[extension_id];
-    std::string event_name(*v8::String::AsciiValue(args[0]));
-    bool is_manual = args[1]->BooleanValue();
-
-    if (--listener_counts[event_name] == 0) {
-      content::RenderThread::Get()->Send(
-          new ExtensionHostMsg_RemoveListener(extension_id, event_name));
+  static v8::Handle<v8::Value> DetachEvent(const v8::Arguments& args) {
+    DCHECK(args.Length() == 2);
+    // TODO(erikkay) should enforce that event name is a string in the bindings
+    DCHECK(args[0]->IsString() || args[0]->IsUndefined());
+
+    if (args[0]->IsString() && args[1]->IsBoolean()) {
+      ExtensionImpl* self = GetFromArguments<ExtensionImpl>(args);
+      const ChromeV8ContextSet& context_set =
+          self->extension_dispatcher()->v8_context_set();
+      ChromeV8Context* context = context_set.GetCurrent();
+      if (!context)
+        return v8::Undefined();
+
+      std::string extension_id = context->GetExtensionID();
+      EventListenerCounts& listener_counts =
+          g_listener_counts.Get()[extension_id];
+      std::string event_name(*v8::String::AsciiValue(args[0]));
+      bool is_manual = args[1]->BooleanValue();
+
+      if (--listener_counts[event_name] == 0) {
+        content::RenderThread::Get()->Send(
+            new ExtensionHostMsg_RemoveListener(extension_id, event_name));
+      }
+
+      // DetachEvent is called when the last listener for the context is
+      // removed. If the context is the background page, and it removes the
+      // last listener manually, then we assume that it is no longer interested
+      // in being awakened for this event.
+      if (is_manual && self->IsLazyBackgroundPage(context->extension())) {
+        content::RenderThread::Get()->Send(
+            new ExtensionHostMsg_RemoveLazyListener(extension_id, event_name));
+      }
     }
 
-    // DetachEvent is called when the last listener for the context is
-    // removed. If the context is the background page, and it removes the
-    // last listener manually, then we assume that it is no longer interested
-    // in being awakened for this event.
-    if (is_manual && IsLazyBackgroundPage(context->extension())) {
-      content::RenderThread::Get()->Send(
-          new ExtensionHostMsg_RemoveLazyListener(extension_id, event_name));
-    }
+    return v8::Undefined();
   }
 
-  return v8::Undefined();
-}
+ private:
+
+  bool IsLazyBackgroundPage(const Extension* extension) {
+    content::RenderView* render_view = GetCurrentRenderView();
+    if (!render_view)
+      return false;
 
-bool EventBindings::IsLazyBackgroundPage(const Extension* extension) {
-  content::RenderView* render_view = GetCurrentRenderView();
-  if (!render_view)
-    return false;
+    ExtensionHelper* helper = ExtensionHelper::Get(render_view);
+    return (extension && extension->has_lazy_background_page() &&
+            helper->view_type() == chrome::VIEW_TYPE_EXTENSION_BACKGROUND_PAGE);
+  }
+};
+
+}  // namespace
 
-  ExtensionHelper* helper = ExtensionHelper::Get(render_view);
-  return (extension && extension->has_lazy_background_page() &&
-          helper->view_type() == chrome::VIEW_TYPE_EXTENSION_BACKGROUND_PAGE);
+ChromeV8Extension* EventBindings::Get(ExtensionDispatcher* dispatcher) {
+  return new ExtensionImpl(dispatcher);
 }
diff --git a/chrome/renderer/extensions/event_bindings.h b/chrome/renderer/extensions/event_bindings.h
index 4b4e99f..baa2004 100644
--- a/chrome/renderer/extensions/event_bindings.h
+++ b/chrome/renderer/extensions/event_bindings.h
@@ -6,9 +6,6 @@
 #define CHROME_RENDERER_EXTENSIONS_EVENT_BINDINGS_H_
 #pragma once
 
-#include "chrome/renderer/extensions/chrome_v8_extension.h"
-#include "v8/include/v8.h"
-
 class ChromeV8Extension;
 class ExtensionDispatcher;
 
@@ -17,15 +14,9 @@ class Extension;
 }
 
 // This class deals with the javascript bindings related to Event objects.
-class EventBindings : public ChromeV8Extension {
+class EventBindings {
  public:
-  explicit EventBindings(ExtensionDispatcher* dispatcher);
-
- private:
-  v8::Handle<v8::Value> AttachEvent(const v8::Arguments& args);
-  v8::Handle<v8::Value> DetachEvent(const v8::Arguments& args);
-
-  bool IsLazyBackgroundPage(const Extension* extension);
+  static ChromeV8Extension* Get(ExtensionDispatcher* dispatcher);
 };
 
 #endif  // CHROME_RENDERER_EXTENSIONS_EVENT_BINDINGS_H_
diff --git a/chrome/renderer/extensions/extension_dispatcher.cc b/chrome/renderer/extensions/extension_dispatcher.cc
index 0a28bf6..c808efa 100644
--- a/chrome/renderer/extensions/extension_dispatcher.cc
+++ b/chrome/renderer/extensions/extension_dispatcher.cc
@@ -449,7 +449,7 @@ bool ExtensionDispatcher::AllowScriptExtension(
 void ExtensionDispatcher::RegisterNativeHandlers(ModuleSystem* module_system,
                                                  ChromeV8Context* context) {
   module_system->RegisterNativeHandler("event_bindings",
-      scoped_ptr<NativeHandler>(new EventBindings(this)));
+      scoped_ptr<NativeHandler>(EventBindings::Get(this)));
   module_system->RegisterNativeHandler("miscellaneous_bindings",
       scoped_ptr<NativeHandler>(MiscellaneousBindings::Get(this)));
   module_system->RegisterNativeHandler("apiDefinitions",