Fixes possible crash in TabStripModel. If during close all a tab was

chrome/browser/tabs/tab_strip_model.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/tabs/tab_strip_model.h"
 
 #include <algorithm>
 
 #include "base/command_line.h"
 #include "base/stl_util-inl.h"
@@ skipping 771 matching lines @@
 
 bool TabStripModel::IsNewTabAtEndOfTabStrip(TabContents* contents) const {
   return LowerCaseEqualsASCII(contents->GetURL().spec(),
                               chrome::kChromeUINewTabURL) &&
       contents == GetContentsAt(count() - 1) &&
       contents->controller().entry_count() == 1;
 }
 
 bool TabStripModel::InternalCloseTabs(const std::vector<int>& indices,
                                       uint32 close_types) {
+  if (indices.empty())
+    return true;
+
   bool retval = true;
 
+  // Map the indices to TabContents, that way if deleting a tab deletes other
+  // tabs we're ok.

[Ben Goodger (Google), 2010/11/11 22:20:28]

Can you mention what situations would cause one tab to delete another?

+  std::vector<TabContents*> tabs;
+  for (size_t i = 0; i < indices.size(); ++i)
+    tabs.push_back(GetContentsAt(indices[i]));
+
   // We only try the fast shutdown path if the whole browser process is *not*
   // shutting down. Fast shutdown during browser termination is handled in
   // BrowserShutdown.
   if (browser_shutdown::GetShutdownType() == browser_shutdown::NOT_VALID) {
     // Construct a map of processes to the number of associated tabs that are
     // closing.
     std::map<RenderProcessHost*, size_t> processes;
     for (size_t i = 0; i < indices.size(); ++i) {
       if (!delegate_->CanCloseContentsAt(indices[i])) {
         retval = false;
@@ skipping 13 matching lines @@
 
     // Try to fast shutdown the tabs that can close.
     for (std::map<RenderProcessHost*, size_t>::iterator iter =
             processes.begin();
         iter != processes.end(); ++iter) {
       iter->first->FastShutdownForPageCount(iter->second);
     }
   }
 
   // We now return to our regularly scheduled shutdown procedure.
-  for (size_t i = 0; i < indices.size(); ++i) {
-    TabContents* detached_contents = GetContentsAt(indices[i]);
+  for (size_t i = 0; i < tabs.size(); ++i) {
+    TabContents* detached_contents = tabs[i];
+    int index = GetIndexOfTabContents(detached_contents);
+    // Make sure we still contain the tab.
+    if (index == kNoTab)
+      continue;
+
     detached_contents->OnCloseStarted();
 
-    if (!delegate_->CanCloseContentsAt(indices[i])) {
+    if (!delegate_->CanCloseContentsAt(index)) {
       retval = false;
       continue;
     }
 
     // Update the explicitly closed state. If the unload handlers cancel the
     // close the state is reset in Browser. We don't update the explicitly
     // closed state if already marked as explicitly closed as unload handlers
     // call back to this if the close is allowed.
     if (!detached_contents->closed_by_user_gesture()) {
       detached_contents->set_closed_by_user_gesture(
           close_types & CLOSE_USER_GESTURE);
     }
 
     if (delegate_->RunUnloadListenerBeforeClosing(detached_contents)) {
       retval = false;
       continue;
     }
 
-    InternalCloseTab(detached_contents, indices[i],
+    InternalCloseTab(detached_contents, index,
                      (close_types & CLOSE_CREATE_HISTORICAL_TAB) != 0);
   }
 
   return retval;
 }
 
 void TabStripModel::InternalCloseTab(TabContents* contents,
                                      int index,
                                      bool create_historical_tabs) {
   FOR_EACH_OBSERVER(TabStripModelObserver, observers_,
@@ skipping 63 matching lines @@
   FOR_EACH_OBSERVER(TabStripModelObserver, observers_,
                     TabMoved(moved_data->contents, index, to_position));
 }
 
 // static
 bool TabStripModel::OpenerMatches(const TabContentsData* data,
                                   const NavigationController* opener,
                                   bool use_group) {
   return data->opener == opener || (use_group && data->group == opener);
 }