1 files changed, 27 insertions, 4 deletions

diff --git a/chrome/browser/extensions/extension_popup_host.cc b/chrome/browser/extensions/extension_popup_host.cc
index f263494..1a964da 100644
--- a/chrome/browser/extensions/extension_popup_host.cc
+++ b/chrome/browser/extensions/extension_popup_host.cc
@@ -18,6 +18,13 @@
 #include "chrome/common/notification_type.h"
 
 
+ExtensionPopupHost::PopupDelegate::~PopupDelegate() {
+  // If the PopupDelegate is being torn down, then make sure to reset the
+  // cached pointer in the host to prevent access to a stale pointer.
+  if (popup_host_.get())
+    popup_host_->RevokeDelegate();
+}
+
 ExtensionPopupHost* ExtensionPopupHost::PopupDelegate::popup_host() {
   if (!popup_host_.get())
     popup_host_.reset(new ExtensionPopupHost(this));
@@ -25,6 +32,18 @@ ExtensionPopupHost* ExtensionPopupHost::PopupDelegate::popup_host() {
   return popup_host_.get();
 }
 
+Profile* ExtensionPopupHost::PopupDelegate::GetProfile() {
+  // If there is a browser present, return the profile associated with it.
+  // When hosting a view in an ExternalTabContainer, it is possible to have
+  // no Browser instance.
+  Browser* browser = GetBrowser();
+  if (browser) {
+    return browser->profile();
+  }
+
+  return NULL;
+}
+
 ExtensionPopupHost::ExtensionPopupHost(PopupDelegate* delegate)
     :  // NO LINT
 #if defined(TOOLKIT_VIEWS)
@@ -35,8 +54,10 @@ ExtensionPopupHost::ExtensionPopupHost(PopupDelegate* delegate)
 
   // Listen for view close requests, so that we can dismiss a hosted pop-up
   // view, if necessary.
+  Profile* profile = delegate_->GetProfile();
+  DCHECK(profile);
   registrar_.Add(this, NotificationType::EXTENSION_HOST_VIEW_SHOULD_CLOSE,
-                 Source<Profile>(delegate_->GetBrowser()->profile()));
+                 Source<Profile>(profile));
 }
 
 ExtensionPopupHost::~ExtensionPopupHost() {
@@ -88,9 +109,11 @@ void ExtensionPopupHost::DismissPopup() {
     delete child_popup_;
     child_popup_ = NULL;
 
-    PopupEventRouter::OnPopupClosed(
-        delegate_->GetBrowser()->profile(),
-        delegate_->GetRenderViewHost()->routing_id());
+    if (delegate_) {
+      PopupEventRouter::OnPopupClosed(
+          delegate_->GetProfile(),
+          delegate_->GetRenderViewHost()->routing_id());
+    }
   }
 #endif  // defined(TOOLKIT_VIEWS)
 }