Fix a crash when closing an incognito window

chrome/browser/views/frame/browser_view.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/views/frame/browser_view.h"
 
 #if defined(OS_LINUX)
 #include <gtk/gtk.h>
 #endif
 
@@ skipping 256 matching lines @@
   explicit_show_state = state;
 }
 
 BrowserView::BrowserView(Browser* browser)
     : views::ClientView(NULL, NULL),
       frame_(NULL),
       browser_(browser),
       active_bookmark_bar_(NULL),
       tabstrip_(NULL),
       toolbar_(NULL),
-      download_shelf_(NULL),
       infobar_container_(NULL),
       find_bar_y_(0),
       contents_container_(NULL),
       initialized_(false),
       ignore_layout_(false),
 #if defined(OS_WIN)
       hung_window_detector_(&hung_plugin_action_),
       ticker_(0),
 #endif
       extension_shelf_(NULL) {
   InitClass();
   browser_->tabstrip_model()->AddObserver(this);
 }
 
 BrowserView::~BrowserView() {
   browser_->tabstrip_model()->RemoveObserver(this);
 
 #if defined(OS_WIN)
   // Stop hung plugin monitoring.
   ticker_.Stop();
   ticker_.UnregisterTickHandler(&hung_window_detector_);
 #endif
 
+  // We destroy the download shelf before |browser_| to remove its child
+  // download views from the set of download observers (since the observed
+  // downloads can be destroyed along with |browser_| and the observer
+  // notifications will call back into deleted objects).
+  download_shelf_.reset();
+
   // Explicitly set browser_ to NULL
   browser_.reset();
 }
 
 // static
 BrowserView* BrowserView::GetBrowserViewForNativeWindow(
     gfx::NativeWindow window) {
 #if defined(OS_WIN)
   if (IsWindow(window)) {
     HANDLE data = GetProp(window, kBrowserViewKey);
@@ skipping 469 matching lines @@
 
 gfx::Rect BrowserView::GetRootWindowResizerRect() const {
   if (frame_->GetWindow()->IsMaximized() || frame_->GetWindow()->IsFullscreen())
     return gfx::Rect();
 
   // We don't specify a resize corner size if we have a bottom shelf either.
   // This is because we take care of drawing the resize corner on top of that
   // shelf, so we don't want others to do it for us in this case.
   // Currently, the only visible bottom shelf is the download shelf.
   // Other tests should be added here if we add more bottom shelves.
-  if (download_shelf_ && download_shelf_->IsShowing()) {
+  if (download_shelf_.get() && download_shelf_->IsShowing()) {
     return gfx::Rect();
   }
 
   gfx::Rect client_rect = contents_container_->bounds();
   gfx::Size resize_corner_size = ResizeCorner::GetSize();
   int x = client_rect.width() - resize_corner_size.width();
   if (l10n_util::GetTextDirection() == l10n_util::RIGHT_TO_LEFT)
     x = 0;
   return gfx::Rect(x, client_rect.height() - resize_corner_size.height(),
                    resize_corner_size.width(), resize_corner_size.height());
@@ skipping 34 matching lines @@
     browser_->UpdateDownloadShelfVisibility(visible);
   }
 
   // SetDownloadShelfVisible can force-close the shelf, so make sure we lay out
   // everything correctly, as if the animation had finished. This doesn't
   // matter for showing the shelf, as the show animation will do it.
   SelectedTabToolbarSizeChanged(false);
 }
 
 bool BrowserView::IsDownloadShelfVisible() const {
-  return download_shelf_ && download_shelf_->IsShowing();
+  return download_shelf_.get() && download_shelf_->IsShowing();
 }
 
 DownloadShelf* BrowserView::GetDownloadShelf() {
-  if (!download_shelf_)
-    download_shelf_ = new DownloadShelfView(browser_.get(), this);
-  return download_shelf_;
+  if (!download_shelf_.get()) {
+    download_shelf_.reset(new DownloadShelfView(browser_.get(), this));
+    download_shelf_->SetParentOwned(false);
+  }
+  return download_shelf_.get();
 }
 
 void BrowserView::ShowReportBugDialog() {
   // Retrieve the URL for the current tab (if any) and tell the BugReportView
   TabContents* current_tab = browser_->GetSelectedTabContents();
   if (!current_tab)
     return;
   browser::ShowBugReportView(GetWidget(), browser_->profile(), current_tab);
 }
 
@@ skipping 624 matching lines @@
 }
 
 void BrowserView::LayoutTabContents(int top, int bottom) {
   contents_container_->SetBounds(0, top, width(), bottom - top);
 }
 
 int BrowserView::LayoutDownloadShelf(int bottom) {
   if (IsDownloadShelfVisible()) {
     bool visible = browser_->SupportsWindowFeature(
         Browser::FEATURE_DOWNLOADSHELF);
-    DCHECK(download_shelf_);
+    DCHECK(download_shelf_.get());
     int height = visible ? download_shelf_->GetPreferredSize().height() : 0;
     download_shelf_->SetVisible(visible);
     download_shelf_->SetBounds(0, bottom - height, width(), height);
     download_shelf_->Layout();
     bottom -= height;
   }
   return bottom;
 }
 
 void BrowserView::LayoutStatusBubble(int top) {
@@ skipping 287 matching lines @@
 
 // static
 FindBar* BrowserWindow::CreateFindBar(Browser* browser) {
   return browser::CreateFindBar(static_cast<BrowserView*>(browser->window()));
 }
 
 // static
 void BrowserList::AllBrowsersClosed() {
   views::Window::CloseAllSecondaryWindows();
 }