[Panels] Fix favicon crash from using deleted WebContents.

chrome/browser/ui/panels/panel_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/panels/panel_host.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/message_loop.h"
 #include "chrome/browser/chrome_page_zoom.h"
@@ skipping 53 matching lines @@
       panel_->session_id());
 
   FaviconTabHelper::CreateForWebContents(web_contents_.get());
   PrefsTabHelper::CreateForWebContents(web_contents_.get());
 
   web_contents_->GetController().LoadURL(
       url, content::Referrer(), content::PAGE_TRANSITION_LINK, std::string());
 }
 
 void PanelHost::DestroyWebContents() {
-  web_contents_.reset();
+  // Cannot do a web_contents_.reset() because web_contents_.get() will
+  // still return the pointer when we CHECK in WebContentsDestroyed (or if
+  // we get called back in the middle of web contents destruction, which
+  // WebView might do when it detects the web contents is destroyed).
+  content::WebContents* contents = web_contents_.release();
+  delete contents;
 }
 
 gfx::Image PanelHost::GetPageIcon() const {
   if (!web_contents_.get())
     return gfx::Image();
 
   FaviconTabHelper* favicon_tab_helper =
       FaviconTabHelper::FromWebContents(web_contents_.get());
-  return favicon_tab_helper->GetFavicon();
+  DCHECK(favicon_tab_helper);

[sky, 2012/10/15 23:34:17]

Make this a CHECK so we can know for sure if its NULL.

[jennb, 2012/10/16 00:17:07]

Done.

+  return favicon_tab_helper ? favicon_tab_helper->GetFavicon() : gfx::Image();
 }
 
 content::WebContents* PanelHost::OpenURLFromTab(
     content::WebContents* source,
     const content::OpenURLParams& params) {
   // These dispositions aren't really navigations.
   if (params.disposition == SUPPRESS_OPEN ||
       params.disposition == SAVE_TO_DISK ||
       params.disposition == IGNORE_ACTION)
     return NULL;
@@ skipping 102 matching lines @@
   extensions::WindowController* window = GetExtensionWindowController();
   render_view_host->Send(new ExtensionMsg_UpdateBrowserWindowId(
       render_view_host->GetRoutingID(), window->GetWindowId()));
 }
 
 void PanelHost::RenderViewGone(base::TerminationStatus status) {
   CloseContents(web_contents_.get());
 }
 
 void PanelHost::WebContentsDestroyed(content::WebContents* web_contents) {
+  // Web contents should only be destroyed by us.
+  CHECK(!web_contents_.get());
+
   // Close the panel after we return to the message loop (not immediately,
   // otherwise, it may destroy this object before the stack has a chance
   // to cleanly unwind.)
   MessageLoop::current()->PostTask(
       FROM_HERE,
       base::Bind(&PanelHost::ClosePanel, weak_factory_.GetWeakPtr()));
 }
 
 void PanelHost::ClosePanel() {
   panel_->Close();
@@ skipping 35 matching lines @@
 }
 
 void PanelHost::StopLoading() {
   content::RecordAction(UserMetricsAction("Stop"));
   web_contents_->Stop();
 }
 
 void PanelHost::Zoom(content::PageZoom zoom) {
   chrome_page_zoom::Zoom(web_contents_.get(), zoom);
 }