Fix NULL dereference in ExtensionTabsModule

chrome/browser/extensions/extension_tabs_module.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_tabs_module.h"
 
 #include "base/base64.h"
 #include "base/string_util.h"
 #include "chrome/browser/browser.h"
 #include "chrome/browser/browser_list.h"
@@ skipping 121 matching lines @@
     }
   }
 
   return result;
 }
 
 // if |populate| is true, each window gets a list property |tabs| which contains
 // fully populated tab objects.
 DictionaryValue* ExtensionTabUtil::CreateWindowValue(const Browser* browser,
                                                      bool populate_tabs) {
+  DCHECK(browser);
+  DCHECK(browser->window());
   DictionaryValue* result = new DictionaryValue();
   result->SetInteger(keys::kIdKey, ExtensionTabUtil::GetWindowId(browser));
-  bool focused = false;
-  if (browser->window())
-    focused = browser->window()->IsActive();
-
   result->SetBoolean(keys::kIncognitoKey,
                      browser->profile()->IsOffTheRecord());
-  result->SetBoolean(keys::kFocusedKey, focused);
+  result->SetBoolean(keys::kFocusedKey, browser->window()->IsActive());
   gfx::Rect bounds = browser->window()->GetRestoredBounds();
 
-  // TODO(rafaelw): zIndex ?
   result->SetInteger(keys::kLeftKey, bounds.x());
   result->SetInteger(keys::kTopKey, bounds.y());
   result->SetInteger(keys::kWidthKey, bounds.width());
   result->SetInteger(keys::kHeightKey, bounds.height());
   result->SetString(keys::kWindowTypeKey, GetWindowTypeText(browser->type()));
 
   if (populate_tabs) {
     result->Set(keys::kTabsKey, ExtensionTabUtil::CreateTabList(browser));
   }
 
@@ skipping 53 matching lines @@
 }
 
 // Windows ---------------------------------------------------------------------
 
 bool GetWindowFunction::RunImpl() {
   int window_id;
   EXTENSION_FUNCTION_VALIDATE(args_->GetInteger(0, &window_id));
 
   Browser* browser = GetBrowserInProfileWithId(profile(), window_id,
                                                include_incognito(), &error_);
-  if (!browser)
+  if (!browser || !browser->window()) {
+    error_ = ExtensionErrorUtils::FormatErrorMessage(
+        keys::kWindowNotFoundError, IntToString(window_id));
     return false;
+  }
 
   result_.reset(ExtensionTabUtil::CreateWindowValue(browser, false));
   return true;
 }
 
 bool GetCurrentWindowFunction::RunImpl() {
   Browser* browser = GetCurrentBrowser();
-  if (!browser) {
+  if (!browser || !browser->window()) {
     error_ = keys::kNoCurrentWindowError;
     return false;
   }
   result_.reset(ExtensionTabUtil::CreateWindowValue(browser, false));
   return true;
 }
 
 bool GetLastFocusedWindowFunction::RunImpl() {
   Browser* browser = BrowserList::FindBrowserWithType(
       profile(), Browser::TYPE_ANY, include_incognito());
-  if (!browser) {
+  if (!browser || !browser->window()) {
     error_ = keys::kNoLastFocusedWindowError;
     return false;
   }
   result_.reset(ExtensionTabUtil::CreateWindowValue(browser, false));
   return true;
 }
 
 bool GetAllWindowsFunction::RunImpl() {
   bool populate_tabs = false;
   if (HasOptionalArgument(0)) {
     DictionaryValue* args;
     EXTENSION_FUNCTION_VALIDATE(args_->GetDictionary(0, &args));
 
     if (args->HasKey(keys::kPopulateKey)) {
       EXTENSION_FUNCTION_VALIDATE(args->GetBoolean(keys::kPopulateKey,
           &populate_tabs));
     }
   }
 
   result_.reset(new ListValue());
   Profile* incognito_profile =
       include_incognito() ? profile()->GetOffTheRecordProfile() : NULL;
   for (BrowserList::const_iterator browser = BrowserList::begin();
     browser != BrowserList::end(); ++browser) {
-      // Only examine browsers in the current profile.
+      // Only examine browsers in the current profile that have windows.
       if ((*browser)->profile() == profile() ||
-          (*browser)->profile() == incognito_profile) {
+          (*browser)->profile() == incognito_profile &&
+          (*browser)->window()) {
         static_cast<ListValue*>(result_.get())->
           Append(ExtensionTabUtil::CreateWindowValue(*browser, populate_tabs));
       }
   }
 
   return true;
 }
 
 bool CreateWindowFunction::RunImpl() {
   GURL url;
@@ skipping 83 matching lines @@
   }
 
   Browser* new_window = new Browser(window_type, window_profile);
   new_window->CreateBrowserWindow();
   new_window->AddTabWithURL(url, GURL(), PageTransition::LINK, -1,
                             TabStripModel::ADD_SELECTED, NULL, std::string());
 
   new_window->window()->SetBounds(bounds);
   new_window->window()->Show();
 
-  // TODO(rafaelw): support |focused|, |zIndex|
   if (new_window->profile()->IsOffTheRecord() && !include_incognito()) {
     // Don't expose incognito windows if the extension isn't allowed.
     result_.reset(Value::CreateNullValue());
   } else {
     result_.reset(ExtensionTabUtil::CreateWindowValue(new_window, false));
   }
 
   return true;
 }
 
 bool UpdateWindowFunction::RunImpl() {
   int window_id;
   EXTENSION_FUNCTION_VALIDATE(args_->GetInteger(0, &window_id));
   DictionaryValue* update_props;
   EXTENSION_FUNCTION_VALIDATE(args_->GetDictionary(1, &update_props));
 
   Browser* browser = GetBrowserInProfileWithId(profile(), window_id,
                                                include_incognito(), &error_);
-  if (!browser)
+  if (!browser || !browser->window()) {
+    error_ = ExtensionErrorUtils::FormatErrorMessage(
+        keys::kWindowNotFoundError, IntToString(window_id));
     return false;
+  }
 
   gfx::Rect bounds = browser->window()->GetRestoredBounds();
   // Any part of the bounds can optionally be set by the caller.
   int bounds_val;
   if (update_props->HasKey(keys::kLeftKey)) {
     EXTENSION_FUNCTION_VALIDATE(update_props->GetInteger(
         keys::kLeftKey,
         &bounds_val));
     bounds.set_x(bounds_val);
   }
@@ skipping 13 matching lines @@
   }
 
   if (update_props->HasKey(keys::kHeightKey)) {
     EXTENSION_FUNCTION_VALIDATE(update_props->GetInteger(
         keys::kHeightKey,
         &bounds_val));
     bounds.set_height(bounds_val);
   }
 
   browser->window()->SetBounds(bounds);
-  // TODO(rafaelw): Support |focused|.
   result_.reset(ExtensionTabUtil::CreateWindowValue(browser, false));
 
   return true;
 }
 
 bool RemoveWindowFunction::RunImpl() {
   int window_id;
   EXTENSION_FUNCTION_VALIDATE(args_->GetInteger(0, &window_id));
 
   Browser* browser = GetBrowserInProfileWithId(profile(), window_id,
@@ skipping 602 matching lines @@
       include_incognito ? profile->GetOffTheRecordProfile() : NULL;
   for (BrowserList::const_iterator browser = BrowserList::begin();
        browser != BrowserList::end(); ++browser) {
     if (((*browser)->profile() == profile ||
          (*browser)->profile() == incognito_profile) &&
         ExtensionTabUtil::GetWindowId(*browser) == window_id)
       return *browser;
   }
 
   if (error_message)
-    *error_message= ExtensionErrorUtils::FormatErrorMessage(
+    *error_message = ExtensionErrorUtils::FormatErrorMessage(
         keys::kWindowNotFoundError, IntToString(window_id));
 
   return NULL;
 }
 
 static bool GetTabById(int tab_id, Profile* profile,
                        bool include_incognito,
                        Browser** browser,
                        TabStripModel** tab_strip,
                        TabContents** contents,
@@ skipping 22 matching lines @@
 }
 
 static GURL ResolvePossiblyRelativeURL(std::string url_string,
                                        Extension* extension) {
   GURL url = GURL(url_string);
   if (!url.is_valid())
     url = extension->GetResourceURL(url_string);
 
   return url;
 }