Revert 90585 - Revert 90578 - Add a CHECK to help track use-after-free of TabContentsDelegate from a TabContents.

BUG=87411,85247
TEST=None


Review URL: http://codereview.chromium.org/7260010

TBR=cbentzel@chromium.org
Review URL: http://codereview.chromium.org/7253005

TBR=cbentzel@chromium.org

Review URL: http://codereview.chromium.org/7276001

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@90993 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 44 insertions, 1 deletions

diff --git a/content/browser/tab_contents/tab_contents.cc b/content/browser/tab_contents/tab_contents.cc
index 813476f..13fcd7c 100644
--- a/content/browser/tab_contents/tab_contents.cc
+++ b/content/browser/tab_contents/tab_contents.cc
@@ -253,6 +253,19 @@ TabContents::~TabContents() {
   FOR_EACH_OBSERVER(TabContentsObserver, observers_, TabContentsDestroyed());
 
   net::NetworkChangeNotifier::RemoveOnlineStateObserver(this);
+
+  set_delegate(NULL);
+}
+
+// TODO(cbentzel): Either remove the debugging code, or rename to SetDelegate.
+void TabContents::set_delegate(TabContentsDelegate* delegate) {
+  if (delegate == delegate_)
+    return;
+  if (delegate_)
+    delegate_->Detach(this);
+  delegate_ = delegate;
+  if (delegate_)
+    delegate_->Attach(this);
 }
 
 void TabContents::AddObservers() {
diff --git a/content/browser/tab_contents/tab_contents.h b/content/browser/tab_contents/tab_contents.h
index 02814dd..861a6a5 100644
--- a/content/browser/tab_contents/tab_contents.h
+++ b/content/browser/tab_contents/tab_contents.h
@@ -98,7 +98,7 @@ class TabContents : public PageNavigator,
   PropertyBag* property_bag() { return &property_bag_; }
 
   TabContentsDelegate* delegate() const { return delegate_; }
-  void set_delegate(TabContentsDelegate* d) { delegate_ = d; }
+  void set_delegate(TabContentsDelegate* delegate);
 
   // Gets the controller for this tab contents.
   NavigationController& controller() { return controller_; }
diff --git a/content/browser/tab_contents/tab_contents_delegate.cc b/content/browser/tab_contents/tab_contents_delegate.cc
index 57fca35..c1f3253 100644
--- a/content/browser/tab_contents/tab_contents_delegate.cc
+++ b/content/browser/tab_contents/tab_contents_delegate.cc
@@ -5,11 +5,15 @@
 #include "content/browser/tab_contents/tab_contents_delegate.h"
 
 #include "base/compiler_specific.h"
+#include "base/logging.h"
 #include "base/memory/singleton.h"
 #include "content/browser/javascript_dialogs.h"
 #include "content/common/url_constants.h"
 #include "ui/gfx/rect.h"
 
+TabContentsDelegate::TabContentsDelegate() {
+}
+
 std::string TabContentsDelegate::GetNavigationHeaders(const GURL& url) {
   return std::string();
 }
@@ -231,4 +235,15 @@ TabContentsDelegate::GetJavaScriptDialogCreator() {
 }
 
 TabContentsDelegate::~TabContentsDelegate() {
+  CHECK(attached_contents_.empty());
+}
+
+void TabContentsDelegate::Attach(TabContents* tab_contents) {
+  CHECK(attached_contents_.find(tab_contents) == attached_contents_.end());
+  attached_contents_.insert(tab_contents);
+}
+
+void TabContentsDelegate::Detach(TabContents* tab_contents) {
+  CHECK(attached_contents_.find(tab_contents) != attached_contents_.end());
+  attached_contents_.erase(tab_contents);
 }
diff --git a/content/browser/tab_contents/tab_contents_delegate.h b/content/browser/tab_contents/tab_contents_delegate.h
index 1089367..652a124 100644
--- a/content/browser/tab_contents/tab_contents_delegate.h
+++ b/content/browser/tab_contents/tab_contents_delegate.h
@@ -6,6 +6,7 @@
 #define CONTENT_BROWSER_TAB_CONTENTS_TAB_CONTENTS_DELEGATE_H_
 #pragma once
 
+#include <set>
 #include <string>
 
 #include "base/basictypes.h"
@@ -41,6 +42,8 @@ class TabContents;
 // TabContents and to provide necessary functionality.
 class TabContentsDelegate {
  public:
+  TabContentsDelegate();
+
   // Opens a new URL inside the passed in TabContents (if source is 0 open
   // in the current front-most tab), unless |disposition| indicates the url
   // should be opened in a new tab or window.
@@ -293,6 +296,18 @@ class TabContentsDelegate {
 
  protected:
   virtual ~TabContentsDelegate();
+
+ private:
+  friend class TabContents;
+
+  // Called when |this| becomes the TabContentsDelegate for |source|.
+  void Attach(TabContents* source);
+
+  // Called when |this| is no longer the TabContentsDelegate for |source|.
+  void Detach(TabContents* source);
+
+  // The TabContents that this is currently a delegate for.
+  std::set<TabContents*> attached_contents_;
 };
 
 #endif  // CONTENT_BROWSER_TAB_CONTENTS_TAB_CONTENTS_DELEGATE_H_