Fix problems with render_widget_host_ being deleted out-of-sync with cocoa_view_.

chrome/browser/renderer_host/render_widget_host_view_mac.mm

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/render_widget_host_view_mac.h"
 
 #include "base/histogram.h"
 #include "base/sys_string_conversions.h"
 #include "chrome/browser/browser_trial.h"
 #import "chrome/browser/cocoa/rwhvm_editcommand_helper.h"
@@ skipping 238 matching lines @@
   // TODO(darin): keep this around, and draw sad-tab into it.
   UpdateCursorIfOverSelf();
   Destroy();
 }
 
 void RenderWidgetHostViewMac::Destroy() {
   // We've been told to destroy.
   [cocoa_view_ retain];
   [cocoa_view_ removeFromSuperview];
   [cocoa_view_ autorelease];
+
+  // We get this call just before |render_widget_host_| deletes
+  // itself.  But we are owned by |cocoa_view_|, which may be retained
+  // by some other code.  Examples are TabContentsViewMac's
+  // |latent_focus_view_| and TabWindowController's
+  // |cachedContentView_|.
+  render_widget_host_ = NULL;
 }
 
 // Called from the renderer to tell us what the tooltip text should be. It
 // calls us frequently so we need to cache the value to prevent doing a lot
 // of repeat work. We cannot simply use [-NSView setToolTip:] because NSView
 // can't handle the case where the tooltip text changes while the mouse is
 // still inside the view. Since the page elements that get tooltips are all
 // contained within this view (and are unknown to the NSView system), we
 // are forced to implement our own tooltips with child windows.
 // TODO(pinkerton): Do we want these tooltips to time out after a certain time?
@@ skipping 119 matching lines @@
   canBeKeyView_ = can;
 }
 
 - (void)setCloseOnDeactivate:(BOOL)b {
   closeOnDeactivate_ = b;
 }
 
 - (void)mouseEvent:(NSEvent *)theEvent {
   const WebMouseEvent& event =
       WebInputEventFactory::mouseEvent(theEvent, self);
-  renderWidgetHostView_->render_widget_host_->ForwardMouseEvent(event);
+  if (renderWidgetHostView_->render_widget_host_)
+    renderWidgetHostView_->render_widget_host_->ForwardMouseEvent(event);
 }
 
 - (void)keyEvent:(NSEvent *)theEvent {
   // TODO(avi): Possibly kill self? See RenderWidgetHostViewWin::OnKeyEvent and
   // http://b/issue?id=1192881 .
 
   NativeWebKeyboardEvent event(theEvent);
-  renderWidgetHostView_->render_widget_host_->ForwardKeyboardEvent(event);
+  if (renderWidgetHostView_->render_widget_host_)
+    renderWidgetHostView_->render_widget_host_->ForwardKeyboardEvent(event);
 }
 
 - (void)scrollWheel:(NSEvent *)theEvent {
   const WebMouseWheelEvent& event =
       WebInputEventFactory::mouseWheelEvent(theEvent, self);
-  renderWidgetHostView_->render_widget_host_->ForwardWheelEvent(event);
+  if (renderWidgetHostView_->render_widget_host_)
+    renderWidgetHostView_->render_widget_host_->ForwardWheelEvent(event);
 }
 
 - (void)setFrame:(NSRect)frameRect {
   [super setFrame:frameRect];
-  renderWidgetHostView_->render_widget_host_->WasResized();
+  if (renderWidgetHostView_->render_widget_host_)
+    renderWidgetHostView_->render_widget_host_->WasResized();
 }
 
 - (void)drawRect:(NSRect)dirtyRect {
+  if (!renderWidgetHostView_->render_widget_host_) {
+    // TODO(shess): Consider using something more noticable?
+    [[NSColor whiteColor] set];
+    NSRectFill(dirtyRect);
+    return;
+  }
+
   DCHECK(renderWidgetHostView_->render_widget_host_->process()->HasConnection());
   DCHECK(!renderWidgetHostView_->about_to_validate_and_paint_);
 
   renderWidgetHostView_->invalid_rect_ = dirtyRect;
   renderWidgetHostView_->about_to_validate_and_paint_ = true;
   BackingStore* backing_store =
       renderWidgetHostView_->render_widget_host_->GetBackingStore(true);
   skia::PlatformCanvas* canvas = backing_store->canvas();
   renderWidgetHostView_->about_to_validate_and_paint_ = false;
   dirtyRect = renderWidgetHostView_->invalid_rect_;
@@ skipping 71 matching lines @@
     }
   } else {
     [[NSColor whiteColor] set];
     NSRectFill(dirtyRect);
     if (renderWidgetHostView_->whiteout_start_time_.is_null())
       renderWidgetHostView_->whiteout_start_time_ = base::TimeTicks::Now();
   }
 }
 
 - (BOOL)canBecomeKeyView {
+  if (!renderWidgetHostView_->render_widget_host_)
+    return NO;
+
   return canBeKeyView_;
 }
 
 - (BOOL)acceptsFirstResponder {
+  if (!renderWidgetHostView_->render_widget_host_)
+    return NO;
+
   return canBeKeyView_;
 }
 
 - (BOOL)becomeFirstResponder {
-  if (![self superview]) {
-    // We're dead, so becoming first responder is probably a bad idea.
+  if (!renderWidgetHostView_->render_widget_host_)
     return NO;
-  }
 
   renderWidgetHostView_->render_widget_host_->Focus();
   return YES;
 }
 
 - (BOOL)resignFirstResponder {
-  if (![self superview]) {
-    // We're dead, so touching renderWidgetHostView_ is probably a bad
-    // idea.
+  if (!renderWidgetHostView_->render_widget_host_)
     return YES;
-  }
 
   if (closeOnDeactivate_)
     renderWidgetHostView_->KillSelf();
 
   renderWidgetHostView_->render_widget_host_->Blur();
 
   return YES;
 }
 
 - (BOOL)validateUserInterfaceItem:(id<NSValidatedUserInterfaceItem>)item {
   SEL action = [item action];
 
   return editCommand_helper_->IsMenuItemEnabled(action, self);
 }
 
 - (RenderWidgetHostViewMac*)renderWidgetHostViewMac {
   return renderWidgetHostView_;
 }
 
 @end