Fix crash bug http://crbug.com/725594

content/browser/frame_host/interstitial_page_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/interstitial_page_impl.h"
 
 #include <utility>
 #include <vector>
 
 #include "base/bind.h"
@@ skipping 145 matching lines @@
       should_discard_pending_nav_entry_(new_navigation),
       enabled_(true),
       action_taken_(NO_ACTION),
       render_view_host_(NULL),
       // TODO(nasko): The InterstitialPageImpl will need to provide its own
       // NavigationControllerImpl to the Navigator, which is separate from
       // the WebContents one, so we can enforce no navigation policy here.
       // While we get the code to a point to do this, pass NULL for it.
       // TODO(creis): We will also need to pass delegates for the RVHM as we
       // start to use it.
-      frame_tree_(new InterstitialPageNavigatorImpl(this, controller_),
-                  this,
-                  this,
-                  this,
-                  static_cast<WebContentsImpl*>(web_contents)),
+      frame_tree_(base::MakeUnique<FrameTree>(
+          new InterstitialPageNavigatorImpl(this, controller_),
+          this,
+          this,
+          this,
+          static_cast<WebContentsImpl*>(web_contents))),
       original_child_id_(web_contents->GetRenderProcessHost()->GetID()),
       original_rvh_id_(web_contents->GetRenderViewHost()->GetRoutingID()),
       should_revert_web_contents_title_(false),
       resource_dispatcher_host_notified_(false),
       rvh_delegate_view_(new InterstitialPageRVHDelegateView(this)),
       create_view_(true),
       pause_throbber_(false),
       delegate_(delegate),
       weak_ptr_factory_(this) {
   InitInterstitialPageMap();
 }
 
 InterstitialPageImpl::~InterstitialPageImpl() {
+  // RenderViewHostImpl::RenderWidgetLostFocus() will be eventually executed in
+  // the destructor of FrameTree. It uses InterstitialPageRVHDelegate, which
+  // will be deleted because std::unique_ptr<InterstitialPageRVHDelegateView> is
+  // placed after frame_tree_. See bug http://crbug.com/725594.
+  frame_tree_.reset();
 }
 
 void InterstitialPageImpl::Show() {
   if (!enabled())
     return;
 
   // If an interstitial is already showing or about to be shown, close it before
   // showing the new one.
   // Be careful not to take an action on the old interstitial more than once.
   InterstitialPageMap::const_iterator iter =
@@ skipping 46 matching lines @@
     static_cast<WebContentsImpl*>(web_contents_)
         ->DidChangeVisibleSecurityState();
   }
 
   DCHECK(!render_view_host_);
   render_view_host_ = CreateRenderViewHost();
   CreateWebContentsView();
 
   GURL data_url = GURL("data:text/html;charset=utf-8," +
                        net::EscapePath(delegate_->GetHTMLContents()));
-  frame_tree_.root()->current_frame_host()->NavigateToInterstitialURL(data_url);
-  frame_tree_.root()->current_frame_host()->UpdateAccessibilityMode();
+  frame_tree_->root()->current_frame_host()->NavigateToInterstitialURL(
+      data_url);
+  frame_tree_->root()->current_frame_host()->UpdateAccessibilityMode();
 
   notification_registrar_.Add(this, NOTIFICATION_NAV_ENTRY_PENDING,
       Source<NavigationController>(controller_));
 }
 
 void InterstitialPageImpl::Hide() {
   // We may have already been hidden, and are just waiting to be deleted.
   // We can't check for enabled() here, because some callers have already
   // called Disable.
   if (!render_view_host_)
@@ skipping 27 matching lines @@
         ->Focus();
   }
 
   // Delete this and call Shutdown on the RVH asynchronously, as we may have
   // been called from a RVH delegate method, and we can't delete the RVH out
   // from under itself.
   base::ThreadTaskRunnerHandle::Get()->PostNonNestableTask(
       FROM_HERE, base::Bind(&InterstitialPageImpl::Shutdown,
                             weak_ptr_factory_.GetWeakPtr()));
   render_view_host_ = NULL;
-  frame_tree_.root()->ResetForNewProcess();
+  frame_tree_->root()->ResetForNewProcess();
   controller_->delegate()->DetachInterstitialPage();
   // Let's revert to the original title if necessary.
   NavigationEntry* entry = controller_->GetVisibleEntry();
   if (entry && !new_navigation_ && should_revert_web_contents_title_)
     web_contents_->UpdateTitleForEntry(entry, original_web_contents_title_);
 
   static_cast<WebContentsImpl*>(web_contents_)->DidChangeVisibleSecurityState();
 
   InterstitialPageMap::iterator iter =
       g_web_contents_to_interstitial_page->find(web_contents_);
@@ skipping 110 matching lines @@
 }
 
 AccessibilityMode InterstitialPageImpl::GetAccessibilityMode() const {
   if (web_contents_)
     return static_cast<WebContentsImpl*>(web_contents_)->GetAccessibilityMode();
   else
     return AccessibilityMode();
 }
 
 void InterstitialPageImpl::Cut() {
-  FrameTreeNode* focused_node = frame_tree_.GetFocusedFrame();
+  FrameTreeNode* focused_node = frame_tree_->GetFocusedFrame();
   if (!focused_node)
     return;
 
   focused_node->current_frame_host()->Send(
       new InputMsg_Cut(focused_node->current_frame_host()->GetRoutingID()));
   RecordAction(base::UserMetricsAction("Cut"));
 }
 
 void InterstitialPageImpl::Copy() {
-  FrameTreeNode* focused_node = frame_tree_.GetFocusedFrame();
+  FrameTreeNode* focused_node = frame_tree_->GetFocusedFrame();
   if (!focused_node)
     return;
 
   focused_node->current_frame_host()->Send(
       new InputMsg_Copy(focused_node->current_frame_host()->GetRoutingID()));
   RecordAction(base::UserMetricsAction("Copy"));
 }
 
 void InterstitialPageImpl::Paste() {
-  FrameTreeNode* focused_node = frame_tree_.GetFocusedFrame();
+  FrameTreeNode* focused_node = frame_tree_->GetFocusedFrame();
   if (!focused_node)
     return;
 
   focused_node->current_frame_host()->Send(
       new InputMsg_Paste(focused_node->current_frame_host()->GetRoutingID()));
   RecordAction(base::UserMetricsAction("Paste"));
 }
 
 void InterstitialPageImpl::SelectAll() {
-  FrameTreeNode* focused_node = frame_tree_.GetFocusedFrame();
+  FrameTreeNode* focused_node = frame_tree_->GetFocusedFrame();
   if (!focused_node)
     return;
 
   focused_node->current_frame_host()->Send(new InputMsg_SelectAll(
       focused_node->current_frame_host()->GetRoutingID()));
   RecordAction(base::UserMetricsAction("SelectAll"));
 }
 
 RenderViewHostDelegateView* InterstitialPageImpl::GetDelegateView() {
   return rvh_delegate_view_.get();
@@ skipping 108 matching lines @@
       static_cast<DOMStorageContextWrapper*>(
           BrowserContext::GetStoragePartition(
               browser_context, site_instance.get())->GetDOMStorageContext());
   session_storage_namespace_ =
       new SessionStorageNamespaceImpl(dom_storage_context);
 
   // Use the RenderViewHost from our FrameTree.
   // TODO(avi): The view routing ID can be restored to MSG_ROUTING_NONE once
   // RenderViewHostImpl has-a RenderWidgetHostImpl. https://crbug.com/545684
   int32_t widget_routing_id = site_instance->GetProcess()->GetNextRoutingID();
-  frame_tree_.root()->render_manager()->Init(
+  frame_tree_->root()->render_manager()->Init(
       site_instance.get(), widget_routing_id, MSG_ROUTING_NONE,
       widget_routing_id, false);
-  return frame_tree_.root()->current_frame_host()->render_view_host();
+  return frame_tree_->root()->current_frame_host()->render_view_host();
 }
 
 WebContentsView* InterstitialPageImpl::CreateWebContentsView() {
   if (!enabled() || !create_view_)
     return NULL;
   WebContentsView* wcv =
       static_cast<WebContentsImpl*>(web_contents())->GetView();
   RenderWidgetHostViewBase* view =
       wcv->CreateViewForWidget(render_view_host_->GetWidget(), false);
   RenderWidgetHostImpl::From(render_view_host_->GetWidget())->SetView(view);
   render_view_host_->GetMainFrame()->AllowBindings(
       BINDINGS_POLICY_DOM_AUTOMATION);
 
   render_view_host_->CreateRenderView(MSG_ROUTING_NONE,
                                       MSG_ROUTING_NONE,
                                       FrameReplicationState(),
                                       false);
   controller_->delegate()->RenderFrameForInterstitialPageCreated(
-      frame_tree_.root()->current_frame_host());
+      frame_tree_->root()->current_frame_host());
   view->SetSize(web_contents()->GetContainerBounds().size());
   // Don't show the interstitial until we have navigated to it.
   view->Hide();
   return wcv;
 }
 
 void InterstitialPageImpl::Proceed() {
   // Don't repeat this if we are already shutting down.  We cannot check for
   // enabled() here, because we may have called Disable without calling Hide.
   if (!render_view_host_)
@@ skipping 124 matching lines @@
     int32_t render_view_route_id,
     int32_t main_frame_route_id,
     int32_t main_frame_widget_route_id,
     const mojom::CreateNewWindowParams& params,
     SessionStorageNamespace* session_storage_namespace) {
   NOTREACHED() << "InterstitialPage does not support showing popups.";
 }
 
 void InterstitialPageImpl::SetFocusedFrame(FrameTreeNode* node,
                                            SiteInstance* source) {
-  frame_tree_.SetFocusedFrame(node, source);
+  frame_tree_->SetFocusedFrame(node, source);
 
   if (web_contents_) {
     static_cast<WebContentsImpl*>(web_contents_)
         ->SetAsFocusedWebContentsIfNecessary();
   }
 }
 
 void InterstitialPageImpl::CreateNewWidget(int32_t render_process_id,
                                            int32_t route_id,
                                            blink::WebPopupType popup_type) {
@@ skipping 25 matching lines @@
   NOTREACHED()
       << "InterstitialPage does not support showing full screen popups.";
 }
 
 SessionStorageNamespace* InterstitialPageImpl::GetSessionStorageNamespace(
     SiteInstance* instance) {
   return session_storage_namespace_.get();
 }
 
 FrameTree* InterstitialPageImpl::GetFrameTree() {
-  return &frame_tree_;
+  return frame_tree_.get();
 }
 
 void InterstitialPageImpl::Disable() {
   enabled_ = false;
 }
 
 void InterstitialPageImpl::Shutdown() {
   delete this;
 }
 
@@ skipping 172 matching lines @@
 RenderWidgetHostInputEventRouter* InterstitialPageImpl::GetInputEventRouter() {
   WebContentsImpl* web_contents_impl =
       static_cast<WebContentsImpl*>(web_contents_);
   if (!web_contents_impl)
     return nullptr;
 
   return web_contents_impl->GetInputEventRouter();
 }
 
 }  // namespace content