Fix crash in WindowEventRouter::OnActiveWindowChanged when closing an incognito window.

chrome/browser/extensions/window_event_router.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/window_event_router.h"
 
 #include "base/json/json_writer.h"
 #include "base/values.h"
 #include "chrome/browser/extensions/event_names.h"
 #include "chrome/browser/extensions/event_router.h"
@@ skipping 110 matching lines @@
       profile_->IsSameProfile(window_controller->profile())) {
     window_profile = window_controller->profile();
     window_id = window_controller->GetWindowId();
   }
 
   if (focused_window_id_ == window_id)
     return;
 
   // window_profile is either the default profile for the active window, its
   // incognito profile, or NULL iff the previous profile is losing focus.
+  // Note that |previous_focused_profile| may already be destroyed!
   Profile* previous_focused_profile = focused_profile_;
   focused_profile_ = window_profile;
   focused_window_id_ = window_id;
 
   base::ListValue real_args;
   real_args.Append(Value::CreateIntegerValue(window_id));
   std::string real_json_args;
   base::JSONWriter::Write(&real_args, &real_json_args);
 
-  // When switching between windows in the default and incognitoi profiles,
+  // When switching between windows in the default and incognito profiles,
   // dispatch WINDOW_ID_NONE to extensions whose profile lost focus that
   // can't see the new focused window across the incognito boundary.
   // See crbug.com/46610.
   std::string none_json_args;
   if (focused_profile_ != NULL && previous_focused_profile != NULL &&
       focused_profile_ != previous_focused_profile) {
     ListValue none_args;
     none_args.Append(
         Value::CreateIntegerValue(extension_misc::kUnknownWindowId));
     base::JSONWriter::Write(&none_args, &none_json_args);
   }
 
-  if (!window_profile)
-    window_profile = previous_focused_profile;
-  if (!profile_->IsSameProfile(window_profile) ||
-      !ExtensionSystem::Get(window_profile)->event_router()) {
+  if ((window_profile && !profile_->IsSameProfile(window_profile)))

[Yoyo Zhou, 2012/08/08 19:36:58]

excessive parentheses

[dcheng, 2012/08/08 20:05:56]

Already removed in my latest snapshot.

     return;
-  }
 
-  ExtensionSystem::Get(window_profile)->event_router()->
+  ExtensionSystem::Get(profile_)->event_router()->

[Yoyo Zhou, 2012/08/08 19:36:58]

This seems to be the important fix.

       DispatchEventsToRenderersAcrossIncognito(
           event_names::kOnWindowFocusedChanged,
           real_json_args,
           window_profile,

[Yoyo Zhou, 2012/08/08 19:36:58]

Are you sure this should be NULL in some cases?

[dcheng, 2012/08/08 20:05:56]

Oops. While I think it's technically OK to pass NULL, it probably doesn't do
what we want...

I'm going to have to think about how to fix this properly...

[dcheng, 2012/08/08 22:08:33]

Passing NULL won't cause any crashes. However, I think it may cause a few extra
callbacks with window_id = WINDOW_ID_NONE across incognito boundaries. This may
be a slight regression, but I don't have a test case to prove my theory one way
or another. Theoretically, the proper fix for crbug.com/141474 will address this
case too...

           none_json_args,
           GURL());
 }
 
 void WindowEventRouter::DispatchEvent(const char* event_name,
                                       Profile* profile,
                                       base::ListValue* args) {
   std::string json_args;
   base::JSONWriter::Write(args, &json_args);
   ExtensionSystem::Get(profile)->event_router()->
       DispatchEventToRenderers(event_name, json_args, profile, GURL());
 }
 
 }  // namespace extensions