Fix crash in LocationBarView when accessing TabContents.

The LocationBarView asks its delegate (the ToolbarView) for a pointer to TabContents. The problem is, the ToolbarView is keeping an internal pointer to TabContents, and that pointer is not getting cleared when the last tab goes away. This can lead to shutdown crashes, which is what I think is happening in the crash in bug 14601. 

This is a speculative fix because we can't reproduce, but according to the dis-assembly we access a corrupt STL struct through a non-null TabContents pointer, which makes sense if the TabContents pointer is not getting cleared (or if the STL struct is being modified through multiple threads, which I have verified it is not).

BUG=14601
TEST=Cannot reproduce, we'll have to watch the crash reports as they come in to see if the crash is fixed.

Review URL: http://codereview.chromium.org/132043

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@18775 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 20 insertions, 21 deletions

diff --git a/chrome/browser/views/toolbar_view.cc b/chrome/browser/views/toolbar_view.cc
index 8a254e7..f3e3f33 100644
--- a/chrome/browser/views/toolbar_view.cc
+++ b/chrome/browser/views/toolbar_view.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -170,7 +170,6 @@ ToolbarView::ToolbarView(Browser* browser)
       bookmark_menu_(NULL),
       profile_(NULL),
       browser_(browser),
-      tab_(NULL),
       profiles_menu_contents_(NULL),
       ALLOW_THIS_IN_INITIALIZER_LIST(
           profiles_helper_(new GetProfilesHelper(this))) {
@@ -219,7 +218,6 @@ void ToolbarView::SetProfile(Profile* profile) {
 }
 
 void ToolbarView::Update(TabContents* tab, bool should_restore_state) {
-  tab_ = tab;
   if (location_bar_)
     location_bar_->Update(should_restore_state ? tab : NULL);
 }
@@ -312,7 +310,7 @@ void ToolbarView::OnGetProfilesDone(
 // ToolbarView, LocationBarView::Delegate implementation:
 
 TabContents* ToolbarView::GetTabContents() {
-  return tab_;
+  return browser_->GetSelectedTabContents();
 }
 
 void ToolbarView::OnInputInProgress(bool in_progress) {
@@ -756,19 +754,22 @@ void ToolbarView::WriteDragData(views::View* sender,
   // If there is a bookmark for the URL, add the bookmark drag data for it. We
   // do this to ensure the bookmark is moved, rather than creating an new
   // bookmark.
-  if (profile_ && profile_->GetBookmarkModel()) {
-    BookmarkNode* node = profile_->GetBookmarkModel()->
-        GetMostRecentlyAddedNodeForURL(tab_->GetURL());
-    if (node) {
-      BookmarkDragData bookmark_data(node);
-      bookmark_data.Write(profile_, data);
+  TabContents* tab = browser_->GetSelectedTabContents();
+  if (tab) {
+    if (profile_ && profile_->GetBookmarkModel()) {
+      BookmarkNode* node = profile_->GetBookmarkModel()->
+          GetMostRecentlyAddedNodeForURL(tab->GetURL());
+      if (node) {
+        BookmarkDragData bookmark_data(node);
+        bookmark_data.Write(profile_, data);
+      }
     }
-  }
 
-  drag_utils::SetURLAndDragImage(tab_->GetURL(),
-                                 UTF16ToWideHack(tab_->GetTitle()),
-                                 tab_->GetFavIcon(),
-                                 data);
+    drag_utils::SetURLAndDragImage(tab->GetURL(),
+                                   UTF16ToWideHack(tab->GetTitle()),
+                                   tab->GetFavIcon(),
+                                   data);
+  }
 #else
   // TODO(port): do bookmark item drag & drop
   NOTIMPLEMENTED();
@@ -777,11 +778,12 @@ void ToolbarView::WriteDragData(views::View* sender,
 
 int ToolbarView::GetDragOperations(views::View* sender, int x, int y) {
   DCHECK(sender == star_);
-  if (!tab_ || !tab_->ShouldDisplayURL() || !tab_->GetURL().is_valid()) {
+  TabContents* tab = browser_->GetSelectedTabContents();
+  if (!tab || !tab->ShouldDisplayURL() || !tab->GetURL().is_valid()) {
     return DragDropTypes::DRAG_NONE;
   }
   if (profile_ && profile_->GetBookmarkModel() &&
-      profile_->GetBookmarkModel()->IsBookmarked(tab_->GetURL())) {
+      profile_->GetBookmarkModel()->IsBookmarked(tab->GetURL())) {
     return DragDropTypes::DRAG_MOVE | DragDropTypes::DRAG_COPY |
            DragDropTypes::DRAG_LINK;
   }
diff --git a/chrome/browser/views/toolbar_view.h b/chrome/browser/views/toolbar_view.h
index efd9d2c..1eaf928 100644
--- a/chrome/browser/views/toolbar_view.h
+++ b/chrome/browser/views/toolbar_view.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -224,9 +224,6 @@ class ToolbarView : public views::View,
   Profile* profile_;
   Browser* browser_;
 
-  // Current tab we're showing state for.
-  TabContents* tab_;
-
   // Contents of the profiles menu to populate with profile names.
   scoped_ptr<views::SimpleMenuModel> profiles_menu_contents_;