Fix handling of tab contents disappearing out from underneath Javascript dialogs.

content/browser/tab_contents/tab_contents.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/tab_contents/tab_contents.h"
 
 #include <cmath>
 
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
@@ skipping 167 matching lines @@
       crashed_error_code_(0),
       waiting_for_response_(false),
       max_page_id_(-1),
       load_state_(net::LOAD_STATE_IDLE, string16()),
       upload_size_(0),
       upload_position_(0),
       displayed_insecure_content_(false),
       capturing_contents_(false),
       is_being_destroyed_(false),
       notify_disconnection_(false),
+      dialog_creator_(NULL),
 #if defined(OS_WIN)
       message_box_active_(CreateEvent(NULL, TRUE, FALSE, NULL)),
 #endif
       is_showing_before_unload_dialog_(false),
       opener_web_ui_type_(WebUI::kNoWebUI),
       closed_by_user_gesture_(false),
       minimum_zoom_percent_(
           static_cast<int>(WebKit::WebView::minTextSizeMultiplier * 100)),
       maximum_zoom_percent_(
           static_cast<int>(WebKit::WebView::maxTextSizeMultiplier * 100)),
       temporary_zoom_settings_(false),
       content_restrictions_(0) {
 
   render_manager_.Init(browser_context, site_instance, routing_id);
 
   // We have the initial size of the view be based on the size of the passed in
   // tab contents (normally a tab from the same window).
   view_->CreateView(base_tab_contents ?
       base_tab_contents->view()->GetContainerSize() : gfx::Size());
 }
 
 TabContents::~TabContents() {
   is_being_destroyed_ = true;
 
   // Clear out any JavaScript state.
-  if (delegate_)
-    delegate_->GetJavaScriptDialogCreator()->ResetJavaScriptState(this);
+  if (dialog_creator_)
+    dialog_creator_->ResetJavaScriptState(this);
 
   NotifyDisconnected();
 
   // First cleanly close all child windows.
   // TODO(mpcomplete): handle case if MaybeCloseChildWindows() already asked
   // some of these to close.  CloseWindows is async, so it might get called
   // twice before it runs.
   CloseConstrainedWindows();
 
   // Notify any observer that have a reference on this tab contents.
@@ skipping 991 matching lines @@
                     DidNavigateMainFramePostCommit(details, params));
 }
 
 void TabContents::DidNavigateAnyFramePostCommit(
     RenderViewHost* render_view_host,
     const content::LoadCommittedDetails& details,
     const ViewHostMsg_FrameNavigate_Params& params) {
   // If we navigate, reset JavaScript state. This does nothing to prevent
   // a malicious script from spamming messages, since the script could just
   // reload the page to stop blocking.
-  if (delegate_)
-    delegate_->GetJavaScriptDialogCreator()->ResetJavaScriptState(this);
+  if (dialog_creator_) {
+    dialog_creator_->ResetJavaScriptState(this);
+    dialog_creator_ = NULL;
+  }
 
   // Notify observers about navigation.
   FOR_EACH_OBSERVER(TabContentsObserver, observers_,
                     DidNavigateAnyFramePostCommit(details, params));
 }
 
 void TabContents::CloseConstrainedWindows() {
   // Clear out any constrained windows since we are leaving this page entirely.
   // To ensure that we iterate over every element in child_windows_ we
   // need to use a copy of child_windows_. Otherwise if
@@ skipping 446 matching lines @@
 
     if (!frame_url.has_host()) {
       title_type = content::JavaScriptDialogCreator::DIALOG_TITLE_NONE;
     } else {
       title_type = content::JavaScriptDialogCreator::DIALOG_TITLE_FORMATTED_URL;
       title = net::FormatUrl(
           frame_url.GetOrigin(),
           content::GetContentClient()->browser()->GetAcceptLangs(this));
     }
 
-    delegate_->GetJavaScriptDialogCreator()->RunJavaScriptDialog(
-        this,
-        title_type,
-        title,
-        flags,
-        message,
-        default_prompt,
-        reply_msg,
-        &suppress_this_message);
+    dialog_creator_ = delegate_->GetJavaScriptDialogCreator();
+    dialog_creator_->RunJavaScriptDialog(this,
+                                         title_type,
+                                         title,
+                                         flags,
+                                         message,
+                                         default_prompt,
+                                         reply_msg,
+                                         &suppress_this_message);
   }
 
   if (suppress_this_message) {
     // If we are suppressing messages, just reply as if the user immediately
     // pressed "Cancel".
     OnDialogClosed(reply_msg, false, string16());
   }
 
   *did_suppress_message = suppress_this_message;
 }
 
 void TabContents::RunBeforeUnloadConfirm(const RenderViewHost* rvh,
                                          const string16& message,
                                          IPC::Message* reply_msg) {
   if (delegate())
     delegate()->WillRunBeforeUnloadConfirm();
 
   bool suppress_this_message =
       rvh->is_swapped_out() ||
       !delegate_ ||
       delegate_->ShouldSuppressDialogs();
   if (suppress_this_message) {
     render_view_host()->JavaScriptDialogClosed(reply_msg, true, string16());
     return;
   }
 
   is_showing_before_unload_dialog_ = true;
-  delegate_->GetJavaScriptDialogCreator()->RunBeforeUnloadDialog(
-      this,
-      message,
-      reply_msg);
+  dialog_creator_ = delegate_->GetJavaScriptDialogCreator();
+  dialog_creator_->RunBeforeUnloadDialog(this,
+                                         message,
+                                         reply_msg);
 }
 
 WebPreferences TabContents::GetWebkitPrefs() {
   WebPreferences web_prefs =
       content::GetContentClient()->browser()->GetWebkitPrefs(
           render_view_host()->process()->browser_context(), false);
 
   // Force accelerated compositing and 2d canvas off for chrome:, about: and
   // chrome-devtools: pages (unless it's specifically allowed).
   if ((GetURL().SchemeIs(chrome::kChromeDevToolsScheme) ||
@@ skipping 191 matching lines @@
 }
 
 void TabContents::SwapInRenderViewHost(RenderViewHost* rvh) {
   render_manager_.SwapInRenderViewHost(rvh);
 }
 
 void TabContents::CreateViewAndSetSizeForRVH(RenderViewHost* rvh) {
   RenderWidgetHostView* rwh_view = view()->CreateViewForWidget(rvh);
   rwh_view->SetSize(view()->GetContainerSize());
 }