Speculative fix for a crash where RenderWidgetHostViewWin tries to access a d...

chrome/browser/renderer_host/render_widget_host_view_win.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/render_widget_host_view_win.h"
 
 #include "app/gfx/canvas.h"
 #include "app/gfx/gdi_util.h"
 #include "app/l10n_util.h"
 #include "app/l10n_util_win.h"
@@ skipping 612 matching lines @@
   DestroyWindow();
 }
 
 void RenderWidgetHostViewWin::Destroy() {
   // We've been told to destroy.
   // By clearing close_on_deactivate_, we prevent further deactivations
   // (caused by windows messages resulting from the DestroyWindow) from
   // triggering further destructions.  The deletion of this is handled by
   // OnFinalMessage();
   close_on_deactivate_ = false;
+
+  // In case OnFinalMessage() does not get called before DestroyWindow()
+  // returns, make sure we don't try to access |render_widget_host_| later.
+  // http://crbug.com/24248
+  render_widget_host_ = NULL;
+
   DestroyWindow();
 }
 
 void RenderWidgetHostViewWin::SetTooltipText(const std::wstring& tooltip_text) {
   // Clamp the tooltip length to kMaxTooltipLength so that we don't
   // accidentally DOS the user with a mega tooltip (since Windows doesn't seem
   // to do this itself).
   const std::wstring& new_tooltip_text =
       l10n_util::TruncateString(tooltip_text, kMaxTooltipLength);
 
@@ skipping 616 matching lines @@
 
     // Create a reference to BrowserAccessibility which MSAA will marshall to
     // the client.
     reference_result = LresultFromObject(IID_IAccessible, wparam,
         static_cast<IAccessible*>(browser_accessibility_root_));
   }
   return reference_result;
 }
 
 void RenderWidgetHostViewWin::OnFinalMessage(HWND window) {
-  render_widget_host_->ViewDestroyed();
+  if (render_widget_host_)
+    render_widget_host_->ViewDestroyed();
   delete this;
 }
 
 void RenderWidgetHostViewWin::TrackMouseLeave(bool track) {
   if (track == track_mouse_leave_)
     return;
   track_mouse_leave_ = track;
 
   DCHECK(m_hWnd);
 
@@ skipping 69 matching lines @@
     // WM_LBUTTONDOWN.
     SetFocus();
   }
 }
 
 void RenderWidgetHostViewWin::ShutdownHost() {
   shutdown_factory_.RevokeAll();
   render_widget_host_->Shutdown();
   // Do not touch any members at this point, |this| has been deleted.
 }