Fix handling of tab contents disappearing out from underneath Javascript dialogs.

content/browser/tab_contents/tab_contents.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_TAB_CONTENTS_TAB_CONTENTS_H_
 #define CONTENT_BROWSER_TAB_CONTENTS_TAB_CONTENTS_H_
 #pragma once
 
 #include <deque>
 #include <map>
@@ skipping 805 matching lines @@
 
   // See getter above.
   bool is_being_destroyed_;
 
   // Indicates whether we should notify about disconnection of this
   // TabContents. This is used to ensure disconnection notifications only
   // happen if a connection notification has happened and that they happen only
   // once.
   bool notify_disconnection_;
 
+  // Pointer to the JavaScript dialog creator, lazily assigned. Used because the
+  // delegate of this TabContents is nulled before its destructor is called.
+  content::JavaScriptDialogCreator* dialog_creator_;
+
 #if defined(OS_WIN)
   // Handle to an event that's set when the page is showing a message box (or
   // equivalent constrained window).  Plugin processes check this to know if
   // they should pump messages then.
   base::win::ScopedHandle message_box_active_;
 #endif
 
   // Set to true when there is an active "before unload" dialog.  When true,
   // we've forced the throbber to start in Navigate, and we need to remember to
   // turn it off in OnJavaScriptMessageBoxClosed if the navigation is canceled.
@@ skipping 30 matching lines @@
   ObserverList<TabContentsObserver> observers_;
 
   // Content restrictions, used to disable print/copy etc based on content's
   // (full-page plugins for now only) permissions.
   int content_restrictions_;
 
   DISALLOW_COPY_AND_ASSIGN(TabContents);
 };
 
 #endif  // CONTENT_BROWSER_TAB_CONTENTS_TAB_CONTENTS_H_