Fix a deleted memory read with the infobars

chrome/browser/tab_contents/tab_contents.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/tab_contents/tab_contents.h"
 
 #include "app/l10n_util.h"
 #include "app/resource_bundle.h"
 #include "base/file_version_info.h"
 #include "base/process_util.h"
@@ skipping 295 matching lines @@
   // TODO(mpcomplete): handle case if MaybeCloseChildWindows() already asked
   // some of these to close.  CloseWindows is async, so it might get called
   // twice before it runs.
   int size = static_cast<int>(child_windows_.size());
   for (int i = size - 1; i >= 0; --i) {
     ConstrainedWindow* window = child_windows_[i];
     if (window)
       window->CloseConstrainedWindow();
   }
 
-  // Notify any lasting InfobarDelegates that have not yet been removed that
-  // whatever infobar they were handling in this TabContents has closed,
-  // because the TabContents is going away entirely.
-  for (int i = 0; i < infobar_delegate_count(); ++i) {
-    InfoBarDelegate* delegate = GetInfoBarDelegateAt(i);
-    delegate->InfoBarClosed();
-  }
-  infobar_delegates_.clear();
-
   // Notify any observer that have a reference on this tab contents.
   NotificationService::current()->Notify(
       NotificationType::TAB_CONTENTS_DESTROYED,
       Source<TabContents>(this),
       NotificationService::NoDetails());
 
+  // Notify any lasting InfobarDelegates that have not yet been removed that
+  // whatever infobar they were handling in this TabContents has closed,
+  // because the TabContents is going away entirely.
+  // This must happen after the TAB_CONTENTS_DESTROYED notification as the
+  // notification may trigger infobars calls that access their delegate. (and
+  // some implementations of InfoBarDelegate do delete themselves on
+  // InfoBarClosed()).
+  for (int i = 0; i < infobar_delegate_count(); ++i) {
+    InfoBarDelegate* delegate = GetInfoBarDelegateAt(i);
+    delegate->InfoBarClosed();
+  }
+  infobar_delegates_.clear();
+
   // TODO(brettw) this should be moved to the view.
 #if defined(OS_WIN)
   // If we still have a window handle, destroy it. GetNativeView can return
   // NULL if this contents was part of a window that closed.
   if (GetNativeView())
     ::DestroyWindow(GetNativeView());
 #endif
 }
 
 // static
@@ skipping 2096 matching lines @@
       NavigationController::LoadCommittedDetails& committed_details =
           *(Details<NavigationController::LoadCommittedDetails>(details).ptr());
       ExpireInfoBars(committed_details);
       break;
     }
 
     default:
       NOTREACHED();
   }
 }