Fix the segfault on Linux when closing a tab that is in tab fullscreen mode.

It is caused by using a TabContentsWrapper pointer after it has been freed.

BUG=100680
TEST=BrowserTest.TestFullscreenBubbleMouseLockState should work on
Linux.


Review URL: http://codereview.chromium.org/8369013

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@106948 0039d316-1c4b-4281-b951-d872f2087c98

5 files changed, 27 insertions, 26 deletions

diff --git a/chrome/browser/ui/browser.cc b/chrome/browser/ui/browser.cc
index ad7b7cd..1b62ba3 100644
--- a/chrome/browser/ui/browser.cc
+++ b/chrome/browser/ui/browser.cc
@@ -3207,6 +3207,15 @@ void Browser::TabInsertedAt(TabContentsWrapper* contents,
 void Browser::TabClosingAt(TabStripModel* tab_strip_model,
                            TabContentsWrapper* contents,
                            int index) {
+  if (fullscreened_tab_ == contents) {
+    ExitTabbedFullscreenModeIfNecessary();
+    // The call to exit fullscreen may result in asynchronous notification of
+    // fullscreen state change (e.g., on Linux). We don't want to rely on it
+    // to call NotifyTabOfFullscreenExitIfNecessary(), because at that point
+    // |fullscreen_tab_| may not be valid. Instead, we call it here to clean up
+    // tab fullscreen related state.
+    NotifyTabOfFullscreenExitIfNecessary();
+  }
   content::NotificationService::current()->Notify(
       content::NOTIFICATION_TAB_CLOSING,
       content::Source<NavigationController>(&contents->controller()),
diff --git a/chrome/browser/ui/browser_browsertest.cc b/chrome/browser/ui/browser_browsertest.cc
index 9ddb466..e8b910d 100644
--- a/chrome/browser/ui/browser_browsertest.cc
+++ b/chrome/browser/ui/browser_browsertest.cc
@@ -877,20 +877,13 @@ IN_PROC_BROWSER_TEST_F(BrowserTest, MAYBE_TestTabExitsItselfFromFullscreen) {
   }
 }
 
-#if defined(OS_LINUX)
-// http://crbug.com/100680.
-#define MAYBE_TestFullscreenBubbleMouseLockState \
-        DISABLED_TestFullscreenBubbleMouseLockState
-#else
-#define MAYBE_TestFullscreenBubbleMouseLockState \
-        TestFullscreenBubbleMouseLockState
-#endif
-
-IN_PROC_BROWSER_TEST_F(BrowserTest, MAYBE_TestFullscreenBubbleMouseLockState) {
+IN_PROC_BROWSER_TEST_F(BrowserTest, TestFullscreenBubbleMouseLockState) {
   ASSERT_TRUE(test_server()->Start());
 
   AddTabAtIndex(0, GURL(chrome::kAboutBlankURL),
                 content::PAGE_TRANSITION_TYPED);
+  AddTabAtIndex(1, GURL(chrome::kAboutBlankURL),
+                content::PAGE_TRANSITION_TYPED);
 
   TabContents* fullscreen_tab = browser()->GetSelectedTabContents();
 
diff --git a/chrome/browser/ui/gtk/fullscreen_exit_bubble_gtk.cc b/chrome/browser/ui/gtk/fullscreen_exit_bubble_gtk.cc
index 8148fb7..374d589 100644
--- a/chrome/browser/ui/gtk/fullscreen_exit_bubble_gtk.cc
+++ b/chrome/browser/ui/gtk/fullscreen_exit_bubble_gtk.cc
@@ -27,10 +27,8 @@ FullscreenExitBubbleGtk::FullscreenExitBubbleGtk(
     Browser* browser,
     const GURL& url,
     FullscreenExitBubbleType bubble_type)
-  : FullscreenExitBubble(browser, url, bubble_type),
-      container_(container),
-      render_widget_host_view_widget_(browser->GetSelectedTabContents()->
-          GetRenderWidgetHostView()->GetNativeView()) {
+    : FullscreenExitBubble(browser, url, bubble_type),
+      container_(container) {
   InitWidgets();
 }
 
@@ -92,26 +90,27 @@ void FullscreenExitBubbleGtk::InitWidgets() {
 
   allow_button_ = gtk_button_new_with_label(
       l10n_util::GetStringUTF8(IDS_FULLSCREEN_ALLOW).c_str());
+  gtk_widget_set_can_focus(allow_button_, FALSE);
   gtk_widget_set_no_show_all(allow_button_, FALSE);
   gtk_box_pack_start(GTK_BOX(hbox_), allow_button_, FALSE, FALSE, 0);
 
   deny_button_ = gtk_button_new_with_label(
       l10n_util::GetStringUTF8(IDS_FULLSCREEN_DENY).c_str());
+  gtk_widget_set_can_focus(deny_button_, FALSE);
   gtk_widget_set_no_show_all(deny_button_, FALSE);
   gtk_box_pack_start(GTK_BOX(hbox_), deny_button_, FALSE, FALSE, 0);
 
   link_ = gtk_chrome_link_button_new(exit_text_utf8.c_str());
+  gtk_widget_set_can_focus(link_, FALSE);
   gtk_widget_set_no_show_all(link_, FALSE);
   gtk_chrome_link_button_set_use_gtk_theme(GTK_CHROME_LINK_BUTTON(link_),
                                            FALSE);
   gtk_box_pack_start(GTK_BOX(hbox_), link_, FALSE, FALSE, 0);
 
-
   instruction_label_ = gtk_label_new(UTF16ToUTF8(GetInstructionText()).c_str());
   gtk_widget_set_no_show_all(instruction_label_, FALSE);
   gtk_box_pack_start(GTK_BOX(hbox_), instruction_label_, FALSE, FALSE, 0);
 
-
   GtkWidget* bubble = gtk_util::CreateGtkBorderBin(
       hbox_, &ui::kGdkWhite,
       kPaddingPx, kPaddingPx, kPaddingPx, kPaddingPx);
@@ -231,16 +230,13 @@ void FullscreenExitBubbleGtk::OnSetFloatingPosition(
 }
 
 void FullscreenExitBubbleGtk::OnLinkClicked(GtkWidget* link) {
-  gtk_widget_grab_focus(render_widget_host_view_widget_);
   ToggleFullscreen();
 }
 
 void FullscreenExitBubbleGtk::OnAllowClicked(GtkWidget* button) {
-  gtk_widget_grab_focus(render_widget_host_view_widget_);
   Accept();
   UpdateContent(url_, bubble_type_);
 }
 void FullscreenExitBubbleGtk::OnDenyClicked(GtkWidget* button) {
-  gtk_widget_grab_focus(render_widget_host_view_widget_);
   Cancel();
 }
diff --git a/chrome/browser/ui/gtk/fullscreen_exit_bubble_gtk.h b/chrome/browser/ui/gtk/fullscreen_exit_bubble_gtk.h
index bac2d36..a35c682 100644
--- a/chrome/browser/ui/gtk/fullscreen_exit_bubble_gtk.h
+++ b/chrome/browser/ui/gtk/fullscreen_exit_bubble_gtk.h
@@ -56,7 +56,6 @@ class FullscreenExitBubbleGtk : public FullscreenExitBubble {
 
   // A pointer to the floating container that is our parent.
   GtkFloatingContainer* container_;
-  GtkWidget* render_widget_host_view_widget_;
 
   // The widget that contains the UI.
   ui::OwnedWidgetGtk ui_container_;
diff --git a/chrome/browser/ui/views/frame/browser_view.cc b/chrome/browser/ui/views/frame/browser_view.cc
index 4124234..627f690 100644
--- a/chrome/browser/ui/views/frame/browser_view.cc
+++ b/chrome/browser/ui/views/frame/browser_view.cc
@@ -792,6 +792,7 @@ void BrowserView::ExitFullscreen() {
 #if defined(OS_WIN)
   ProcessFullscreen(false, GURL(), FEB_TYPE_NONE);
 #else
+  fullscreen_request_.pending = false;
   // On Linux changing fullscreen is async. Ask the window to change it's
   // fullscreen state, and when done invoke ProcessFullscreen.
   frame_->SetFullscreen(false);
@@ -814,12 +815,15 @@ bool BrowserView::IsFullscreenBubbleVisible() const {
 }
 
 void BrowserView::FullScreenStateChanged() {
-  bool is_fullscreen = IsFullscreen();
-  if (is_fullscreen) {
-    DCHECK(fullscreen_request_.pending);
-    fullscreen_request_.pending = false;
-    ProcessFullscreen(true, fullscreen_request_.url,
-                      fullscreen_request_.bubble_type);
+  if (IsFullscreen()) {
+    if (fullscreen_request_.pending) {
+      fullscreen_request_.pending = false;
+      ProcessFullscreen(true, fullscreen_request_.url,
+                        fullscreen_request_.bubble_type);
+    } else {
+      ProcessFullscreen(true, GURL(),
+                        FEB_TYPE_BROWSER_FULLSCREEN_EXIT_INSTRUCTION);
+    }
   } else {
     ProcessFullscreen(false, GURL(), FEB_TYPE_NONE);
   }