Fix crashes in AutomationInternalCustomBindings due to no v8 context.

chrome/renderer/extensions/automation_internal_custom_bindings.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/automation_internal_custom_bindings.h"
 
 #include "base/bind.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/thread_task_runner_handle.h"
 #include "base/values.h"
@@ skipping 116 matching lines @@
   ROUTE_FUNCTION(GetBoolAttribute);
   ROUTE_FUNCTION(GetIntAttribute);
   ROUTE_FUNCTION(GetFloatAttribute);
   ROUTE_FUNCTION(GetIntListAttribute);
   ROUTE_FUNCTION(GetHtmlAttribute);
 
   #undef ROUTE_FUNCTION
 }
 
 AutomationInternalCustomBindings::~AutomationInternalCustomBindings() {
   if (message_filter_)

[David Tseng, 2015/11/03 18:37:44]

Perhaps this class needs to override Invalidate (and do this teardown logic
there)?

[dmazzoni, 2015/11/06 22:49:58]

Good catch. Done, that seems to work.

     message_filter_->Detach();
-  STLDeleteContainerPairSecondPointers(tree_id_to_tree_cache_map_.begin(),
-                                       tree_id_to_tree_cache_map_.end());
+
+  // Delete the TreeCaches quickly by first clearing their delegates so
+  // we don't get a callback for every node being deleted.
+  for (auto iter : tree_id_to_tree_cache_map_) {
+    TreeCache* cache = iter.second;
+    cache->tree.SetDelegate(nullptr);
+    delete cache;
+  }
 }
 
 void AutomationInternalCustomBindings::OnMessageReceived(
     const IPC::Message& message) {
   IPC_BEGIN_MESSAGE_MAP(AutomationInternalCustomBindings, message)
     IPC_MESSAGE_HANDLER(ExtensionMsg_AccessibilityEvent, OnAccessibilityEvent)
   IPC_END_MESSAGE_MAP()
 }
 
 void AutomationInternalCustomBindings::IsInteractPermitted(
@@ skipping 470 matching lines @@
 }
 
 void AutomationInternalCustomBindings::SendTreeChangeEvent(
     api::automation::TreeChangeType change_type,
     ui::AXTree* tree,
     ui::AXNode* node) {
   // Don't send tree change events when it's not the active profile.
   if (!is_active_profile_)
     return;
 
+  if (!GetIsolate() || !context())

[David Tseng, 2015/11/03 18:37:44]

Do you need to do this if teardown occurs in Invalidate?

[dmazzoni, 2015/11/06 22:49:58]

Probably not.

+    return;
+
   auto iter = axtree_to_tree_cache_map_.find(tree);
   if (iter == axtree_to_tree_cache_map_.end())
     return;
 
   int tree_id = iter->second->tree_id;
 
   v8::HandleScope handle_scope(GetIsolate());
   v8::Context::Scope context_scope(context()->v8_context());
   v8::Local<v8::Array> args(v8::Array::New(GetIsolate(), 3U));
   args->Set(0U, v8::Integer::New(GetIsolate(), tree_id));
   args->Set(1U, v8::Integer::New(GetIsolate(), node->id()));
   args->Set(2U, CreateV8String(ToString(change_type)));
   context()->DispatchEvent("automationInternal.onTreeChange", args);
 }
 
 }  // namespace extensions