Fix potential edge case crashes in ExtensionToolbarModel

chrome/browser/extensions/extension_toolbar_model.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_toolbar_model.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/message_loop/message_loop.h"
@@ skipping 193 matching lines @@
   DCHECK_EQ(NOTIFICATION_EXTENSION_BROWSER_ACTION_VISIBILITY_CHANGED, type);
   const Extension* extension =
       ExtensionRegistry::Get(profile_)->GetExtensionById(
           *content::Details<const std::string>(details).ptr(),
           ExtensionRegistry::EVERYTHING);
 
   bool visible = ExtensionActionAPI::GetBrowserActionVisibility(
                      extension_prefs_, extension->id());
   // Hiding works differently with the new and old toolbars.
   if (include_all_extensions_) {
+    // It's possible that we haven't added this extension yet, if its
+    // visibility was adjusted in the course of its initialization.
+    if (std::find(toolbar_items_.begin(), toolbar_items_.end(), extension) ==
+            toolbar_items_.end())
+      return;
+
     int new_size = 0;
     int new_index = 0;
     if (visible) {
       // If this action used to be hidden, we can't possibly be showing all.
       DCHECK_NE(-1, visible_icon_count_);
       // Grow the bar by one and move the extension to the end of the visibles.
       new_size = visible_icon_count_ + 1;
       new_index = new_size - 1;
     } else {
       // If we're hiding one, we must be showing at least one.
@@ skipping 124 matching lines @@
     }
   }
 }
 
 void ExtensionToolbarModel::RemoveExtension(const Extension* extension) {
   ExtensionList::iterator pos =
       std::find(toolbar_items_.begin(), toolbar_items_.end(), extension);
   if (pos == toolbar_items_.end())
     return;
 
+  // If our visible count is set to the current size, we need to decrement it.
+  if (visible_icon_count_ == static_cast<int>(toolbar_items_.size()))
+    SetVisibleIconCount(toolbar_items_.size() - 1);
+
   toolbar_items_.erase(pos);
 
   // If we're in highlight mode, we also have to remove the extension from
   // the highlighted list.
   if (is_highlighting_) {
     pos = std::find(highlighted_items_.begin(),
                     highlighted_items_.end(),
                     extension);
     if (pos != highlighted_items_.end()) {
       highlighted_items_.erase(pos);
@@ skipping 304 matching lines @@
   if (is_highlighting_) {
     highlighted_items_.clear();
     is_highlighting_ = false;
     if (old_visible_icon_count_ != visible_icon_count_)
       SetVisibleIconCount(old_visible_icon_count_);
     FOR_EACH_OBSERVER(Observer, observers_, ToolbarHighlightModeChanged(false));
   }
 }
 
 }  // namespace extensions