fix DOMUI pages after install of .crx

chrome/browser/renderer_host/render_view_host_manager.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/render_view_host_manager.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "chrome/browser/dom_ui/dom_ui.h"
 #include "chrome/browser/dom_ui/dom_ui_factory.h"
@@ skipping 47 matching lines @@
     site_instance = SiteInstance::CreateSiteInstance(profile);
   render_view_host_ = RenderViewHostFactory::Create(
       site_instance, render_view_delegate_, routing_id, modal_dialog_event);
   NotificationService::current()->Notify(
       NotificationType::RENDER_VIEW_HOST_CREATED_FOR_TAB,
       Source<RenderViewHostManager>(this),
       Details<RenderViewHost>(render_view_host_));
 }
 
 RenderViewHost* RenderViewHostManager::Navigate(const NavigationEntry& entry) {
-  // This will possibly create (set to NULL) a DOM UI object for the pending
-  // page. We'll use this later to give the page special access. This must
-  // happen before the new renderer is created below so it will get bindings.
-  pending_dom_ui_.reset(delegate_->CreateDOMUIForRenderManager(entry.url()));
-
   // Create a pending RenderViewHost. It will give us the one we should use
   RenderViewHost* dest_render_view_host = UpdateRendererStateForNavigate(entry);
   if (!dest_render_view_host)
     return NULL;  // We weren't able to create a pending render view host.
 
   // If the current render_view_host_ isn't live, we should create it so
   // that we don't show a sad tab while the dest_render_view_host fetches
   // its first page.  (Bug 1145340)
   if (dest_render_view_host != render_view_host_ &&
       !render_view_host_->IsRenderViewLive()) {
@@ skipping 403 matching lines @@
 RenderViewHost* RenderViewHostManager::UpdateRendererStateForNavigate(
     const NavigationEntry& entry) {
   // If we are cross-navigating, then we want to get back to normal and navigate
   // as usual.
   if (cross_navigation_pending_) {
     if (pending_render_view_host_)
       CancelPending();
     cross_navigation_pending_ = false;
   }
 
+  // This will possibly create (set to NULL) a DOM UI object for the pending
+  // page. We'll use this later to give the page special access. This must
+  // happen before the new renderer is created below so it will get bindings.
+  // It must also happen after the above conditional call to CancelPending(),
+  // otherwise CancelPending may clear the pending_dom_ui_ and the page will
+  // not have it's bindings set appropriately.
+  pending_dom_ui_.reset(delegate_->CreateDOMUIForRenderManager(entry.url()));
+
   // render_view_host_ will not be deleted before the end of this method, so we
   // don't have to worry about this SiteInstance's ref count dropping to zero.
   SiteInstance* curr_instance = render_view_host_->site_instance();
 
   // Determine if we need a new SiteInstance for this entry.
   // Again, new_instance won't be deleted before the end of this method, so it
   // is safe to use a normal pointer here.
   SiteInstance* new_instance = curr_instance;
   if (ShouldTransitionCrossSite())
     new_instance = GetSiteInstanceForEntry(entry, curr_instance);
@@ skipping 74 matching lines @@
 
   pending_dom_ui_.reset();
 }
 
 void RenderViewHostManager::CrossSiteNavigationCanceled() {
   DCHECK(cross_navigation_pending_);
   cross_navigation_pending_ = false;
   if (pending_render_view_host_)
     CancelPending();
 }