Fix crashes in DownloadRequestLimiter when extension popups/bubbles initiate downloads automatically

chrome/browser/extensions/extension_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_host.h"
 
 #include <list>
 
 #include "base/bind.h"
 #include "base/memory/singleton.h"
@@ skipping 41 matching lines @@
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/layout.h"
 #include "ui/base/resource/resource_bundle.h"
 
 #if defined(TOOLKIT_VIEWS)
 #include "ui/views/widget/widget.h"
 #endif
 
 using WebKit::WebDragOperation;
 using WebKit::WebDragOperationsMask;
+using content::DownloadItem;
 using content::NativeWebKeyboardEvent;
 using content::OpenURLParams;
 using content::RenderViewHost;
 using content::SiteInstance;
 using content::WebContents;
 
 // Helper class that rate-limits the creation of renderer processes for
 // ExtensionHosts, to avoid blocking the UI.
 class ExtensionHost::ProcessCreationQueue {
  public:
@@ skipping 331 matching lines @@
   // TODO(mpcomplete): is this check really necessary?
   if (extension_host_type_ == chrome::VIEW_TYPE_EXTENSION_POPUP ||
       extension_host_type_ == chrome::VIEW_TYPE_EXTENSION_DIALOG ||
       extension_host_type_ == chrome::VIEW_TYPE_EXTENSION_BACKGROUND_PAGE ||
       extension_host_type_ == chrome::VIEW_TYPE_EXTENSION_INFOBAR ||
       extension_host_type_ == chrome::VIEW_TYPE_PANEL) {
     Close();
   }
 }
 
+void ExtensionHost::OnStartDownload(
+    WebContents* source, DownloadItem* download) {
+  Profile* profile = Profile::FromBrowserContext(source->GetBrowserContext());
+  Browser* browser = browser::FindTabbedBrowser(
+      profile, false);  // Match incognito exactly.

[Ben Goodger (Google), 2012/05/29 18:23:48]

So, this pattern is effectively equivalent to BrowserList::GetLastActive() and
you shouldn't be doing this.

The ExtensionHost should (and may already) carry some state that allows proper
context to be obtained safely.

+  if (!browser && view())
+    browser = view()->browser();
+  if (browser)
+    browser->OnStartDownload(source, download);
+}
+
 void ExtensionHost::WillRunJavaScriptDialog() {
   ExtensionProcessManager* pm =
       ExtensionSystem::Get(profile_)->process_manager();
   if (pm)
     pm->IncrementLazyKeepaliveCount(extension());
 }
 
 void ExtensionHost::DidCloseJavaScriptDialog() {
   ExtensionProcessManager* pm =
       ExtensionSystem::Get(profile_)->process_manager();
@@ skipping 167 matching lines @@
   params.user_gesture = user_gesture;
   browser::Navigate(&params);
 }
 
 void ExtensionHost::RenderViewReady() {
   content::NotificationService::current()->Notify(
       chrome::NOTIFICATION_EXTENSION_HOST_CREATED,
       content::Source<Profile>(profile_),
       content::Details<ExtensionHost>(this));
 }