[Panels] Fix favicon crash from using deleted WebContents.

chrome/browser/ui/panels/panel_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/panels/panel_host.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/message_loop.h"
 #include "chrome/browser/chrome_page_zoom.h"
@@ skipping 185 matching lines @@
   extensions::WindowController* window = GetExtensionWindowController();
   render_view_host->Send(new ExtensionMsg_UpdateBrowserWindowId(
       render_view_host->GetRoutingID(), window->GetWindowId()));
 }
 
 void PanelHost::RenderViewGone(base::TerminationStatus status) {
   CloseContents(web_contents_.get());
 }
 
 void PanelHost::WebContentsDestroyed(content::WebContents* web_contents) {
+  DCHECK(web_contents == web_contents_.get());
+  web_contents_.reset();

[sky, 2012/10/11 01:03:54]

WebContentsDestroyed is invoked from ~WebContents (well, ~WebContentsImpl). That
means if you get here and web_contents_ is valid you're going to attempt to
delete it again.

If this class owns the WebContents wrapped in web_contents_ and its always
deleting through the scopedptr, this code is unecessary. If someone else is
deleting the WebContents out from under you, then you need a
web_contents_.release() here.

   // Close the panel after we return to the message loop (not immediately,
   // otherwise, it may destroy this object before the stack has a chance
   // to cleanly unwind.)
   MessageLoop::current()->PostTask(
       FROM_HERE,
       base::Bind(&PanelHost::ClosePanel, weak_factory_.GetWeakPtr()));
 }
 
 void PanelHost::ClosePanel() {
   panel_->Close();
@@ skipping 35 matching lines @@
 }
 
 void PanelHost::StopLoading() {
   content::RecordAction(UserMetricsAction("Stop"));
   web_contents_->Stop();
 }
 
 void PanelHost::Zoom(content::PageZoom zoom) {
   chrome_page_zoom::Zoom(web_contents_.get(), zoom);
 }