[Autofill] Handle the Tab Key in the new UI

content/browser/renderer_host/render_widget_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 
 #include <math.h>
 #include <utility>
 
 #include "base/auto_reset.h"
@@ skipping 2200 matching lines @@
 
 void RenderWidgetHostImpl::SetIgnoreInputEvents(bool ignore_input_events) {
   ignore_input_events_ = ignore_input_events;
 }
 
 bool RenderWidgetHostImpl::KeyPressListenersHandleEvent(
     const NativeWebKeyboardEvent& event) {
   if (event.skip_in_browser || event.type != WebKeyboardEvent::RawKeyDown)
     return false;
 
-  for (std::list<KeyboardListener*>::iterator it = keyboard_listeners_.begin();
-       it != keyboard_listeners_.end(); ++it) {
-    if ((*it)->HandleKeyPressEvent(event))
+  std::list<KeyboardListener*>::iterator it = keyboard_listeners_.begin();
+  while(it != keyboard_listeners_.end()) {
+    // It is possible for the handler to delete itself and not handle the key
+    // press.
+    if ((*(it++))->HandleKeyPressEvent(event))

[Ilya Sherman, 2013/04/18 00:33:32]

This isn't guaranteed to work.  You should (a) use an ObserverList, (b) make a
local copy of the list, or (c) ensure that it's not possible for the listener to
delete itself when handling the key press.  Option (a) is probably the best if
we can use it, since this is pretty much what the ObserverList is designed for.

There are at least a couple of ways that you could achieve that last option:
  (1) Have the listener return that it handled the event, then re-post it.
  (2) Delay the destruction of the listener until after this loop completes, by
posting a task to the current MessageLoop.

[csharp, 2013/04/18 19:53:02]

Ah, I didn't know about ObserverList, awesome.

       return true;
   }
 
   return false;
 }
 
 void RenderWidgetHostImpl::ProcessKeyboardEventAck(int type, bool processed) {
   if (key_queue_.empty()) {
     LOG(ERROR) << "Got a KeyEvent back from the renderer but we "
                << "don't seem to have sent it to the renderer!";
@@ skipping 246 matching lines @@
     return;
 
   OnRenderAutoResized(new_size);
 }
 
 void RenderWidgetHostImpl::DetachDelegate() {
   delegate_ = NULL;
 }
 
 }  // namespace content