Fixes possible crash in closing window. The sequence when closing a

window ends like:

~TabStrip
~View
~Tab
~Tab::TabContextMenuContents
~TabStrip::TabContextMenuContents
TabStrip::StopAllHighlighting

This is problematic as StopAllHighlighting references objects whose
destructor has already run. This crashes on Linux, but not on windows
(probably because of different implementation of stl).

I've fixed this by deleting all child views from ~TabStrip so that if
they end up calling into the TabStrip every is still valid.

BUG=none
TEST=create a couple of tabs, bring up the context menu for each,
     close the context menu, close the window and make sure you don't get a
     crash. Be sure and test this on both windows and Chrome OS.

Review URL: http://codereview.chromium.org/505066

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@35151 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 6 insertions, 0 deletions

diff --git a/chrome/browser/views/tabs/tab_strip.cc b/chrome/browser/views/tabs/tab_strip.cc
index 30a7cac..82849fa 100644
--- a/chrome/browser/views/tabs/tab_strip.cc
+++ b/chrome/browser/views/tabs/tab_strip.cc
@@ -722,6 +722,8 @@ TabStrip::TabStrip(TabStripModel* model)
 }
 
 TabStrip::~TabStrip() {
+  active_animation_.reset(NULL);
+
   // TODO(beng): (1031854) Restore this line once XPFrame/VistaFrame are dead.
   // model_->RemoveObserver(this);
 
@@ -732,6 +734,10 @@ TabStrip::~TabStrip() {
   // crash in the case where the user closes the window after closing a tab
   // but before moving the mouse.
   RemoveMessageLoopObserver();
+
+  // The children (tabs) may callback to us from their destructor. Delete them
+  // so that if they call back we aren't in a weird state.
+  RemoveAllChildViews(true);
 }
 
 bool TabStrip::CanProcessInputEvents() const {