[Panels] Fix favicon crash from using deleted WebContents.

chrome/browser/ui/panels/panel_host.cc

Index: chrome/browser/ui/panels/panel_host.cc
diff --git a/chrome/browser/ui/panels/panel_host.cc b/chrome/browser/ui/panels/panel_host.cc
index a8d7704cc5f8973e5e8e1caa10c491bc7d9ea220..aae910ab9a6f6b7f948fd9ba880b2f9fab54d648 100644
--- a/chrome/browser/ui/panels/panel_host.cc
+++ b/chrome/browser/ui/panels/panel_host.cc
@@ -71,7 +71,12 @@ void PanelHost::Init(const GURL& url) {
 }
 
 void PanelHost::DestroyWebContents() {
-  web_contents_.reset();
+  // Cannot do a web_contents_.reset() because web_contents_.get() will
+  // still return the pointer when we CHECK in WebContentsDestroyed (or if
+  // we get called back in the middle of web contents destruction, which
+  // WebView might do when it detects the web contents is destroyed).
+  content::WebContents* contents = web_contents_.release();
+  delete contents;
 }
 
 gfx::Image PanelHost::GetPageIcon() const {
@@ -80,7 +85,8 @@ gfx::Image PanelHost::GetPageIcon() const {
 
   FaviconTabHelper* favicon_tab_helper =
       FaviconTabHelper::FromWebContents(web_contents_.get());
-  return favicon_tab_helper->GetFavicon();
+  DCHECK(favicon_tab_helper);

[sky, 2012/10/15 23:34:17]

Make this a CHECK so we can know for sure if its NULL.

[jennb, 2012/10/16 00:17:07]

Done.

+  return favicon_tab_helper ? favicon_tab_helper->GetFavicon() : gfx::Image();
 }
 
 content::WebContents* PanelHost::OpenURLFromTab(
@@ -203,6 +209,9 @@ void PanelHost::RenderViewGone(base::TerminationStatus status) {
 }
 
 void PanelHost::WebContentsDestroyed(content::WebContents* web_contents) {
+  // Web contents should only be destroyed by us.
+  CHECK(!web_contents_.get());
+
   // Close the panel after we return to the message loop (not immediately,
   // otherwise, it may destroy this object before the stack has a chance
   // to cleanly unwind.)