Fix crash when an extension popup shows a JS alert. Showing the alert takes...

chrome/browser/app_modal_dialog.h

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_APP_MODAL_DIALOG_H_
 #define CHROME_BROWSER_APP_MODAL_DIALOG_H_
 
 #include <string>
 
 #include "build/build_config.h"
 #include "chrome/common/notification_observer.h"
 #include "chrome/common/notification_registrar.h"
 
 #if defined(OS_WIN)
 class JavascriptMessageBoxDialog;
 typedef JavascriptMessageBoxDialog* NativeDialog;
 #elif defined(OS_LINUX)
 typedef struct _GtkWidget GtkWidget;
 typedef GtkWidget* NativeDialog;
 #elif defined(OS_MACOSX)
 typedef void* NativeDialog;
 #endif
 
+class ExtensionHost;
 class JavaScriptMessageBoxClient;
 class TabContents;
 namespace IPC {
 class Message;
 }
 
 // A controller+model class for javascript alert, confirm, prompt, and
 // onbeforeunload dialog boxes.  |NativeDialog| is a platform specific
 // view.
 class AppModalDialog : public NotificationObserver {
@@ skipping 55 matching lines @@
   void CancelWindow();
 
  private:
   void InitNotifications();
 
   // NotificationObserver implementation.
   virtual void Observe(NotificationType type,
                        const NotificationSource& source,
                        const NotificationDetails& details);
 
-  // Sends APP_MODAL_DIALOG_CLOSED notification.
-  void SendCloseNotification();
+  // Cleans up after the dialog closes for any reason: sends close
+  // notification and re-enables input events.
+  void Cleanup();
 
   NotificationRegistrar registrar_;
 
   // A reference to the platform native dialog box.
   NativeDialog dialog_;
 
   // An implementation of the client interface to provide supporting methods
   // and receive results.
   JavaScriptMessageBoxClient* client_;
 
+  // The client_ as an ExtensionHost, cached for use during notifications that
+  // may arrive after the client has entered its destructor (and is thus
+  // treated as a base JavaScriptMessageBoxClient). This will be NULL if the
+  // client is not an ExtensionHost.
+  TabContents* tab_contents_;
+  ExtensionHost* extension_host_;
+
   // True if the dialog should no longer be shown, e.g. because the underlying
   // tab navigated away while the dialog was queued.
   bool skip_this_dialog_;
 
   // Information about the message box is held in the following variables.
   std::wstring title_;
   int dialog_flags_;
   std::wstring message_text_;
   std::wstring default_prompt_text_;
   bool display_suppress_checkbox_;
   bool is_before_unload_dialog_;
   IPC::Message* reply_msg_;
 };
 
 #endif  // CHROME_BROWSER_APP_MODAL_DIALOG_H_