Fix crash when DecrementCapturerCount() makes a delayed WasHidden() call...

Fix crash when DecrementCapturerCount() makes a delayed WasHidden() call during WebContentsImpl destruction.

Two parts:

1. WebContentsImpl::DecrementCapturerCount() will restore the true "WasHidden" status of the RenderWidgetHost once the counter reaches zero.  However, DecrementCapturerCount() can be called [indirectly] from the WebContentsImpl destructor.  In this case, it should not attempt to change/notify anything.

2. It's possible for ThumbnailTabHelper::WidgetHidden() to call ThumbnailTabHelper::UpdateThumbnailIfNecessary() with a NULL pointer.  Added a NULL check.

BUG=175275,130097


Review URL: https://chromiumcodereview.appspot.com/12209104

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@181876 0039d316-1c4b-4281-b951-d872f2087c98

chrome/browser/thumbnails/thumbnail_tab_helper.cc

@@ -208,7 +208,7 @@ void ThumbnailTabHelper::UpdateThumbnailIfNecessary(
   // Destroying a WebContents may trigger it to be hidden, prompting a snapshot
   // which would be unwise to attempt <http://crbug.com/130097>. If the
   // WebContents is in the middle of destruction, do not risk it.
-  if (web_contents->IsBeingDestroyed())
+  if (!web_contents || web_contents->IsBeingDestroyed())
     return;
   // Skip if a pending entry exists. WidgetHidden can be called while navigating
   // pages and this is not a time when thumbnails should be generated.

content/browser/web_contents/web_contents_impl.cc

@@ -1034,6 +1034,7 @@ bool WebContentsImpl::DisplayedInsecureContent() const {
 }
 
 void WebContentsImpl::IncrementCapturerCount() {
+  DCHECK(!is_being_destroyed_);
   ++capturer_count_;
   DVLOG(1) << "There are now " << capturer_count_
            << " capturing(s) of WebContentsImpl@" << this;
@@ -1043,7 +1044,8 @@ void WebContentsImpl::IncrementCapturerCount() {
   if (capturer_count_ == 1) {
     // Force a WebkitPreferences reload to disable compositing for snapshots.
     RenderViewHost* rvh = GetRenderViewHost();
-    rvh->UpdateWebkitPreferences(rvh->GetWebkitPreferences());
+    if (rvh)
+      rvh->UpdateWebkitPreferences(rvh->GetWebkitPreferences());
   }
 #endif
 }
@@ -1054,12 +1056,16 @@ void WebContentsImpl::DecrementCapturerCount() {
            << " capturing(s) of WebContentsImpl@" << this;
   DCHECK_LE(0, capturer_count_);
 
+  if (is_being_destroyed_)
+    return;
+
 #if defined(OS_LINUX) && !defined(USE_AURA)
   // Temporary fix for Linux non-Aura capturing. http://crbug.com/174957
   if (capturer_count_ == 0) {
     // Force a WebkitPreferences reload to re-enable compositing.
     RenderViewHost* rvh = GetRenderViewHost();
-    rvh->UpdateWebkitPreferences(rvh->GetWebkitPreferences());
+    if (rvh)
+      rvh->UpdateWebkitPreferences(rvh->GetWebkitPreferences());
   }
 #endif