Fix crash when incognito split mode extension using the WebRequest API was reloaded

This fixes a CHECK assertion that was triggered if an incognito split mode
extension with two background pages (each having an active web reqeust event
listener) was restarted. The reason for the bug was that the event listener
from the incognito background page would not be unregistered properly.

BUG=224094
NOTRY=true

Review URL: https://chromiumcodereview.appspot.com/13572005

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@192537 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 62 insertions, 1 deletions

diff --git a/chrome/browser/extensions/api/web_request/web_request_apitest.cc b/chrome/browser/extensions/api/web_request/web_request_apitest.cc
index c64d0bd..2f53bb5 100644
--- a/chrome/browser/extensions/api/web_request/web_request_apitest.cc
+++ b/chrome/browser/extensions/api/web_request/web_request_apitest.cc
@@ -272,3 +272,31 @@ IN_PROC_BROWSER_TEST_F(ExtensionWebRequestApiTest,
                        DeclarativeSendMessage) {
   ASSERT_TRUE(RunExtensionTest("webrequest_sendmessage")) << message_;
 }
+
+// Check that reloading an extension that runs in incognito split mode and
+// has two active background pages with registered events does not crash the
+// browser. Regression test for http://crbug.com/224094
+IN_PROC_BROWSER_TEST_F(ExtensionWebRequestApiTest, IncognitoSplitModeReload) {
+  // Wait for rules to be set up.
+  ExtensionTestMessageListener listener("done", true);
+  ExtensionTestMessageListener listener_incognito("done_incognito", true);
+
+  const extensions::Extension* extension = LoadExtensionWithFlags(
+      test_data_dir_.AppendASCII("webrequest_reload"),
+      kFlagEnableIncognito);
+  ASSERT_TRUE(extension);
+  ui_test_utils::OpenURLOffTheRecord(browser()->profile(), GURL("about:blank"));
+
+  EXPECT_TRUE(listener.WaitUntilSatisfied());
+  EXPECT_TRUE(listener_incognito.WaitUntilSatisfied());
+
+  // Reload extension and wait for rules to be set up again. This should not
+  // crash the browser.
+  ExtensionTestMessageListener listener2("done", true);
+  ExtensionTestMessageListener listener_incognito2("done_incognito", true);
+
+  ReloadExtension(extension->id());
+
+  EXPECT_TRUE(listener2.WaitUntilSatisfied());
+  EXPECT_TRUE(listener_incognito2.WaitUntilSatisfied());
+}
diff --git a/chrome/browser/extensions/event_router.cc b/chrome/browser/extensions/event_router.cc
index 769ced8..4a75636 100644
--- a/chrome/browser/extensions/event_router.cc
+++ b/chrome/browser/extensions/event_router.cc
@@ -257,10 +257,14 @@ void EventRouter::OnListenerRemoved(const EventListener* listener) {
   if (observer != observers_.end())
     observer->second->OnListenerRemoved(details);
 
+  void* profile =
+      listener->process
+          ? Profile::FromBrowserContext(listener->process->GetBrowserContext())
+          : NULL;
   BrowserThread::PostTask(
       BrowserThread::IO, FROM_HERE,
       base::Bind(&NotifyEventListenerRemovedOnIOThread,
-                 profile_, listener->extension_id, event_name));
+                 profile, listener->extension_id, event_name));
 
   const Extension* extension = extensions::ExtensionSystem::Get(profile_)->
       extension_service()->GetExtensionById(listener->extension_id,
diff --git a/chrome/test/data/extensions/api_test/webrequest_reload/background.js b/chrome/test/data/extensions/api_test/webrequest_reload/background.js
new file mode 100644
index 0000000..e8e55f4
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/webrequest_reload/background.js
@@ -0,0 +1,16 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+chrome.webRequest.onBeforeRequest.addListener(
+  function(details) {
+  },
+  {
+    urls: [],
+    types: []
+  },
+  []);
+if (chrome.extension.inIncognitoContext)
+  chrome.test.sendMessage("done_incognito");
+else
+  chrome.test.sendMessage("done");
diff --git a/chrome/test/data/extensions/api_test/webrequest_reload/manifest.json b/chrome/test/data/extensions/api_test/webrequest_reload/manifest.json
new file mode 100644
index 0000000..0498f1b
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/webrequest_reload/manifest.json
@@ -0,0 +1,13 @@
+{
+    "name": "WebRequest + incognito = crash",
+    "incognito":"split",
+    "version": "1",
+    "manifest_version": 2,
+    "background": {
+        "scripts": ["background.js"]
+    },
+    "permissions": [
+        "webRequest",
+        "<all_urls>"
+    ]
+}