Speculative fix for instant overlay crash

We're getting some crashes in
-[OverlayableContentsController setOverlay:...].

I wasn't able to reproduce the crash. My guess is that we're somehow
referencing a stale WebContents pointer.

This is a speculative fix that clears the WebContents reference when
the object is destroyed. I'll revert this change if we continue to
see crashes.

BUG=230880

Review URL: https://codereview.chromium.org/14242004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@194440 0039d316-1c4b-4281-b951-d872f2087c98

chrome/browser/ui/cocoa/tab_contents/instant_overlay_controller_mac.h

@@ -8,12 +8,15 @@
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
 #include "chrome/browser/ui/search/instant_overlay_controller.h"
+#include "content/public/browser/notification_observer.h"
+#include "content/public/browser/notification_registrar.h"
 
 class Browser;
 @class BrowserWindowController;
 @class OverlayableContentsController;
 
-class InstantOverlayControllerMac : public InstantOverlayController {
+class InstantOverlayControllerMac : public InstantOverlayController,
+                                    public content::NotificationObserver {
  public:
   InstantOverlayControllerMac(Browser* browser,
                               BrowserWindowController* window,
@@ -21,11 +24,17 @@ class InstantOverlayControllerMac : public InstantOverlayController {
   virtual ~InstantOverlayControllerMac();
 
  private:
-  // Overridden from InstantOverlayController:
+  // InstantOverlayController:
   virtual void OverlayStateChanged(const InstantOverlayModel& model) OVERRIDE;
 
+  // content::NotificationObserver:
+  virtual void Observe(int type,
+                       const content::NotificationSource& source,
+                       const content::NotificationDetails& details) OVERRIDE;
+
   BrowserWindowController* const window_;
   OverlayableContentsController* const overlay_;
+  content::NotificationRegistrar registrar_;
 
   DISALLOW_COPY_AND_ASSIGN(InstantOverlayControllerMac);
 };

chrome/browser/ui/cocoa/tab_contents/instant_overlay_controller_mac.mm

@@ -13,6 +13,8 @@
 #include "chrome/browser/ui/search/search_model.h"
 #include "chrome/browser/ui/search/search_tab_helper.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
+#include "content/public/browser/notification_source.h"
+#include "content/public/browser/notification_types.h"
 
 InstantOverlayControllerMac::InstantOverlayControllerMac(
     Browser* browser,
@@ -66,4 +68,20 @@ void InstantOverlayControllerMac::OverlayStateChanged(
   }
 
   [window_ updateBookmarkBarStateForInstantOverlay];
+
+  registrar_.RemoveAll();
+  if (model.GetOverlayContents()) {
+    registrar_.Add(
+        this,
+        content::NOTIFICATION_WEB_CONTENTS_DESTROYED,
+        content::Source<content::WebContents>(model.GetOverlayContents()));
+  }
+}
+
+void InstantOverlayControllerMac::Observe(
+    int type,
+    const content::NotificationSource& source,
+    const content::NotificationDetails& details) {
+  [overlay_ onWebContentsDestroyed:
+          content::Source<content::WebContents>(source).ptr()];
 }

chrome/browser/ui/cocoa/tab_contents/overlayable_contents_controller.h

@@ -97,6 +97,8 @@ class WebContents;
 
 - (InstantOverlayControllerMac*)instantOverlayController;
 
+- (void)onWebContentsDestroyed:(content::WebContents*)webContents;
+
 @end
 
 #endif  // CHROME_BROWSER_UI_COCOA_TAB_CONTENTS_OVERLAYABLE_CONTENTS_CONTROLLER_H_

chrome/browser/ui/cocoa/tab_contents/overlayable_contents_controller.mm

@@ -130,6 +130,13 @@
   return instantOverlayController_.get();
 }
 
+- (void)onWebContentsDestroyed:(content::WebContents*)webContents {
+  if (overlayContents_ == webContents) {
+    [overlayContents_->GetView()->GetNativeView() removeFromSuperview];
+    overlayContents_ = NULL;
+  }
+}
+
 - (NSView*)activeContainer {
   return activeContainer_.get();
 }