Merge 106075 - Crash fix.

chrome/browser/instant/instant_controller.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/instant/instant_controller.h"
 
 #include "base/command_line.h"
 #include "base/message_loop.h"
 #include "base/metrics/histogram.h"
 #include "base/rand_util.h"
@@ skipping 213 matching lines @@
 }
 
 bool InstantController::IsCurrent() {
   // TODO(mmenke):  See if we can do something more intelligent in the
   //                navigation pending case.
   return is_displayable_ && !loader_->IsNavigationPending() &&
       !loader_->needs_reload();
 }
 
 bool InstantController::PrepareForCommit() {
+  // Basic checks to prevent accessing a dangling |tab_contents_| pointer.
+  // http://crbug.com/100521.
+  if (is_out_of_date_ || !loader_.get())
+    return false;
+
   // If we are not in the HIDDEN field trial, return the status of the preview.
-  if (!tab_contents_ ||
-      !InstantFieldTrial::IsHiddenExperiment(tab_contents_->profile())) {
+  if (!InstantFieldTrial::IsHiddenExperiment(tab_contents_->profile()))
     return IsCurrent();
-  }
 
   TemplateURLService* model = TemplateURLServiceFactory::GetForProfile(
       tab_contents_->profile());
   if (!model)
     return false;
 
   const TemplateURL* template_url = model->GetDefaultSearchProvider();
-  if (is_out_of_date_ ||
-      !IsValidInstantTemplateURL(template_url) ||
-      !loader_.get() ||
+  if (!IsValidInstantTemplateURL(template_url) ||
       loader_->template_url_id() != template_url->id() ||
       loader_->IsNavigationPending() ||
       loader_->is_determining_if_page_supports_instant()) {
     return false;
   }
 
   // Ignore the suggested text, as we are about to commit the verbatim query.
   string16 suggested_text;
   UpdateLoader(template_url, last_url_, last_transition_type_, last_user_text_,
                true, &suggested_text);
@@ skipping 127 matching lines @@
   loader_->MaybeLoadInstantURL(tab_contents, template_url);
 }
 
 TabContentsWrapper* InstantController::ReleasePreviewContents(
     InstantCommitType type) {
   if (!loader_.get())
     return NULL;
 
   TabContentsWrapper* tab = loader_->ReleasePreviewContents(type);
   ClearBlacklist();
+  is_out_of_date_ = true;
   is_displayable_ = false;
   commit_on_mouse_up_ = false;
   omnibox_bounds_ = gfx::Rect();
   loader_.reset();
   return tab;
 }
 
 void InstantController::CompleteRelease(TabContentsWrapper* tab) {
   tab->blocked_content_tab_helper()->SetAllContentsBlocked(false);
 }
@@ skipping 129 matching lines @@
   if (destroy_factory_.empty()) {
     MessageLoop::current()->PostTask(
         FROM_HERE, destroy_factory_.NewRunnableMethod(
             &InstantController::DestroyLoaders));
   }
 }
 
 void InstantController::DestroyLoaders() {
   loaders_to_destroy_.reset();
 }