Add a method to the controller to close the picker/service tab when a return value is passed.

content/browser/intents/intent_injector.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/intents/intent_injector.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/string16.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/tab_contents/tab_contents.h"
 #include "content/public/common/content_switches.h"
 #include "ipc/ipc_message_macros.h"
 #include "webkit/glue/web_intent_data.h"
 #include "webkit/glue/web_intent_reply_data.h"
 
 IntentInjector::IntentInjector(TabContents* tab_contents)
     : TabContentsObserver(tab_contents),
       intent_id_(0) {
   DCHECK(tab_contents);
 }
 
 IntentInjector::~IntentInjector() {
 }
 
 void IntentInjector::TabContentsDestroyed(TabContents* tab) {
   if (source_tab_.get() != NULL) {
-    source_tab_->Send(new IntentsMsg_WebIntentReply(
+    scoped_ptr<IPC::Message::Sender> sender;
+    sender.swap(source_tab_);
+    sender->Send(new IntentsMsg_WebIntentReply(
         0, webkit_glue::WEB_INTENT_SERVICE_TAB_CLOSED, string16(), intent_id_));
-    source_tab_.reset(NULL);
   }
 
   delete this;
 }
 
 void IntentInjector::SourceTabContentsDestroyed(TabContents* tab) {
   source_tab_.reset(NULL);
 }
 
 void IntentInjector::SetIntent(IPC::Message::Sender* source_tab,
@@ skipping 48 matching lines @@
 }
 
 void IntentInjector::OnReply(const IPC::Message& message,
                              webkit_glue::WebIntentReplyType reply_type,
                              const string16& data,
                              int intent_id) {
   if (!CommandLine::ForCurrentProcess()->HasSwitch(switches::kEnableWebIntents))
     NOTREACHED();
 
   if (source_tab_.get() != NULL) {
-    source_tab_->Send(new IntentsMsg_WebIntentReply(
+    // Swap before use since sending this message may cause
+    // TabContentsDestroyed to be called.
+    scoped_ptr<IPC::Message::Sender> sender;
+    sender.swap(source_tab_);
+    sender->Send(new IntentsMsg_WebIntentReply(
         0, reply_type, data, intent_id));
-    source_tab_.reset(NULL);
   }
 }