Don't crash when closing interstitial pages.

BUG=363564
TEST=as in bug

Review URL: https://codereview.chromium.org/239393009

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@266759 0039d316-1c4b-4281-b951-d872f2087c98

content/browser/frame_host/interstitial_page_impl.cc

@@ -357,7 +357,18 @@ void InterstitialPageImpl::NavigationEntryCommitted(
   OnNavigatingAwayOrTabClosing();
 }
 
+void InterstitialPageImpl::WebContentsWillBeDestroyed() {
+  OnNavigatingAwayOrTabClosing();
+}
+
 void InterstitialPageImpl::WebContentsDestroyed(WebContents* web_contents) {
+  // WebContentsImpl will only call WebContentsWillBeDestroyed for interstitial
+  // pages that it knows about, pages that called
+  // WebContentsImpl::AttachInterstitialPage. But it's possible to have an
+  // interstitial page that never progressed that far. In that case, ensure that
+  // this interstitial page is destroyed. (And if it was attached, and
+  // OnNavigatingAwayOrTabClosing was called, it's safe to call
+  // OnNavigatingAwayOrTabClosing twice.)
   OnNavigatingAwayOrTabClosing();
 }
 

content/browser/frame_host/interstitial_page_impl.h

@@ -69,6 +69,10 @@ class CONTENT_EXPORT InterstitialPageImpl
   virtual void SetSize(const gfx::Size& size) OVERRIDE;
   virtual void Focus() OVERRIDE;
 
+  // This is called by a hosting WebContents to notify this interstitial page
+  // that it is going away.
+  void WebContentsWillBeDestroyed();
+
   // Allows the user to navigate away by disabling the interstitial, canceling
   // the pending request, and unblocking the hidden renderer.  The interstitial
   // will stay visible until the navigation completes.

content/browser/web_contents/web_contents_impl.cc

@@ -363,6 +363,14 @@ WebContentsImpl::WebContentsImpl(
 WebContentsImpl::~WebContentsImpl() {
   is_being_destroyed_ = true;
 
+  // If there is an interstitial page being shown, tell it to close down early
+  // so that this contents will be alive enough to handle all the UI triggered
+  // by that. <http://crbug.com/363564>
+  InterstitialPageImpl* interstitial_page =
+      static_cast<InterstitialPageImpl*>(GetInterstitialPage());
+  if (interstitial_page)
+    interstitial_page->WebContentsWillBeDestroyed();
+
   // Delete all RFH pending shutdown, which will lead the corresponding RVH to
   // shutdown and be deleted as well.
   frame_tree_.ForEach(
@@ -1769,7 +1777,7 @@ void WebContentsImpl::AttachInterstitialPage(
 }
 
 void WebContentsImpl::DetachInterstitialPage() {
-  if (GetInterstitialPage())
+  if (ShowingInterstitialPage())
     GetRenderManager()->remove_interstitial_page();
   FOR_EACH_OBSERVER(WebContentsObserver, observers_,
                     DidDetachInterstitialPage());