Fixe use after free during destruction

chrome/browser/ui/views/frame/browser_view_browsertest.cc

Index: chrome/browser/ui/views/frame/browser_view_browsertest.cc
diff --git a/chrome/browser/ui/views/frame/browser_view_browsertest.cc b/chrome/browser/ui/views/frame/browser_view_browsertest.cc
new file mode 100644
index 0000000000000000000000000000000000000000..d564b786d228d0c2d075ac520ddb0d0200f68112
--- /dev/null
+++ b/chrome/browser/ui/views/frame/browser_view_browsertest.cc
@@ -0,0 +1,56 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/views/frame/browser_view.h"
+
+#include "chrome/browser/ui/browser.h"
+#include "chrome/browser/ui/browser_tabstrip.h"
+#include "chrome/browser/ui/tabs/tab_strip_model.h"
+#include "chrome/test/base/in_process_browser_test.h"
+#include "content/public/browser/invalidate_type.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/browser/web_contents_observer.h"
+
+typedef InProcessBrowserTest BrowserViewTest;
+
+namespace {
+
+// Used to simulate scenario in a crash. When WebContentsDestroyed() is invoked
+// updates the navigation state of another tab.
+class TestWebContentsObserver : public content::WebContentsObserver {
+ public:
+  TestWebContentsObserver(content::WebContents* source,
+                          content::WebContents* other)
+      : content::WebContentsObserver(source),
+        other_(other) {}
+  virtual ~TestWebContentsObserver() {}
+
+  virtual void WebContentsDestroyed(
+      content::WebContents* web_contents) OVERRIDE {
+    other_->NotifyNavigationStateChanged(
+        content::INVALIDATE_TYPE_URL | content::INVALIDATE_TYPE_LOAD);
+  }
+
+ private:
+  content::WebContents* other_;
+
+  DISALLOW_COPY_AND_ASSIGN(TestWebContentsObserver);
+};
+
+}  // namespace
+
+// Verifies don't crash when CloseNow() is invoked with two tabs in a browser.
+// Additionally when one of the tabs is destroyed NotifyNavigationStateChanged()
+// is invoked on the other.
+IN_PROC_BROWSER_TEST_F(BrowserViewTest, CloseWithTabs) {
+  Browser* browser2 =
+      new Browser(Browser::CreateParams(browser()->profile(),
+                                        browser()->host_desktop_type()));
+  chrome::AddBlankTabAt(browser2, -1, true);
+  chrome::AddBlankTabAt(browser2, -1, true);
+  TestWebContentsObserver observer(
+      browser2->tab_strip_model()->GetWebContentsAt(0),
+      browser2->tab_strip_model()->GetWebContentsAt(1));
+  BrowserView::GetBrowserViewForBrowser(browser2)->GetWidget()->CloseNow();
+}