Fix crasher and possible security vulnerability in popup

handling.

B=1368898
Review URL: http://codereview.chromium.org/2437

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@2079 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 13 insertions, 1 deletions

diff --git a/chrome/browser/views/constrained_window_impl.cc b/chrome/browser/views/constrained_window_impl.cc
index 85d9e58..5e766e5 100644
--- a/chrome/browser/views/constrained_window_impl.cc
+++ b/chrome/browser/views/constrained_window_impl.cc
@@ -850,6 +850,8 @@ void ConstrainedWindowImpl::ActivateConstrainedWindow() {
     return;
   }
 
+  StopSuppressedAnimation();
+
   // Other pop-ups are simply moved to the front of the z-order.
   SetWindowPos(HWND_TOP, 0, 0, 0, 0, SWP_NOMOVE | SWP_NOSIZE | SWP_SHOWWINDOW);
 
@@ -1016,6 +1018,11 @@ void ConstrainedWindowImpl::StartSuppressedAnimation() {
   animation_->Start();
 }
 
+void ConstrainedWindowImpl::StopSuppressedAnimation() {
+  animation_->Stop();
+  animation_.reset();
+}
+
 void ConstrainedWindowImpl::CloseContents(TabContents* source) {
   Close();
 }
@@ -1158,6 +1165,9 @@ bool ConstrainedWindowImpl::CanDetach() const {
 
 void ConstrainedWindowImpl::Detach() {
   DCHECK(CanDetach());
+
+  StopSuppressedAnimation();
+
   // Tell the container not to restore focus to whatever view was focused last,
   // since this will interfere with the new window activation in the case where
   // a constrained window is destroyed by being detached.
diff --git a/chrome/browser/views/constrained_window_impl.h b/chrome/browser/views/constrained_window_impl.h
index 46022ae..4218918 100644
--- a/chrome/browser/views/constrained_window_impl.h
+++ b/chrome/browser/views/constrained_window_impl.h
@@ -93,6 +93,9 @@ class ConstrainedWindowImpl : public ConstrainedWindow,
   // this suppressed constrained popup window.
   void StartSuppressedAnimation();
 
+  // Stops the ConstrainedWindowAnimation, making the entire titlebar visible.
+  void StopSuppressedAnimation();
+
  protected:
   // Windows message handlers:
   virtual void OnDestroy();
@@ -202,4 +205,3 @@ class ConstrainedWindowImpl : public ConstrainedWindow,
 };
 
 #endif  // #ifndef CHROME_BROWSER_CONSTRAINED_WINDOW_IMPL_H_
-