Fix crash due to VisibilityTimerTabHelper not being cancelled

chrome/browser/notifications/notification_permission_context_unittest.cc

Index: chrome/browser/notifications/notification_permission_context_unittest.cc
diff --git a/chrome/browser/notifications/notification_permission_context_unittest.cc b/chrome/browser/notifications/notification_permission_context_unittest.cc
index ead50bf0ca0134143d47225b71603051d986333d..c00a9631bb645aa8ccb3b099134ae5f3cb2b36e3 100644
--- a/chrome/browser/notifications/notification_permission_context_unittest.cc
+++ b/chrome/browser/notifications/notification_permission_context_unittest.cc
@@ -189,6 +189,38 @@ TEST_F(NotificationPermissionContextTest, TestDenyInIncognitoAfterDelay) {
   base::MessageLoop::current()->SetTaskRunner(old_task_runner);
 }
 
+// Tests that navigating cancels incognito permission requests without crashing.
+TEST_F(NotificationPermissionContextTest, TestCancelledIncognitoRequest) {
+  TestNotificationPermissionContext permission_context(
+      profile()->GetOffTheRecordProfile());
+  GURL url("https://www.example.com");
+  NavigateAndCommit(url);
+
+  const PermissionRequestID id(web_contents()->GetRenderProcessHost()->GetID(),
+                               web_contents()->GetMainFrame()->GetRoutingID(),
+                               -1);
+
+  scoped_refptr<base::SingleThreadTaskRunner> old_task_runner(

[Peter Beverloo, 2016/02/16 15:28:28]

The TestMockTimeTaskRunner is now being instantiated in three places (130-135,
203-208 and 239-244), and removed three times as well.

Let's add a helper method + automatic restore in TearDown() if the
|old_task_runner_| is not NULL?

[johnme, 2016/02/16 18:14:34]

Done.

+      base::MessageLoop::current()->task_runner());
+  scoped_refptr<base::TestMockTimeTaskRunner> task_runner(
+      new base::TestMockTimeTaskRunner(base::Time::Now(),
+                                       base::TimeTicks::Now()));
+  base::MessageLoop::current()->SetTaskRunner(task_runner);
+
+  permission_context.RequestPermission(
+      web_contents(), id, url, true /* user_gesture */, base::Bind(&DoNothing));
+
+  permission_context.CancelPermissionRequest(web_contents(), id);
+
+  task_runner->FastForwardBy(base::TimeDelta::FromDays(1));
+
+  EXPECT_EQ(0, permission_context.permission_set_count());
+  EXPECT_EQ(CONTENT_SETTING_ASK,
+            permission_context.GetContentSettingFromMap(url, url));
+
+  base::MessageLoop::current()->SetTaskRunner(old_task_runner);
+}
+
 // Tests how multiple parallel permission requests get auto-denied in incognito.
 TEST_F(NotificationPermissionContextTest, TestParallelDenyInIncognito) {
   TestNotificationPermissionContext permission_context(