Fix crash when incognito split mode extension using the WebRequest API was reloaded

This fixes a CHECK assertion that was triggered if an incognito split mode
extension with two background pages (each having an active web reqeust event
listener) was restarted. The reason for the bug was that the event listener
from the incognito background page would not be unregistered properly.

BUG=224094
NOTRY=true

Review URL: https://chromiumcodereview.appspot.com/13572005

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@192537 0039d316-1c4b-4281-b951-d872f2087c98

chrome/browser/extensions/api/web_request/web_request_apitest.cc

@@ -272,3 +272,31 @@ IN_PROC_BROWSER_TEST_F(ExtensionWebRequestApiTest,
                        DeclarativeSendMessage) {
   ASSERT_TRUE(RunExtensionTest("webrequest_sendmessage")) << message_;
 }
+
+// Check that reloading an extension that runs in incognito split mode and
+// has two active background pages with registered events does not crash the
+// browser. Regression test for http://crbug.com/224094
+IN_PROC_BROWSER_TEST_F(ExtensionWebRequestApiTest, IncognitoSplitModeReload) {
+  // Wait for rules to be set up.
+  ExtensionTestMessageListener listener("done", true);
+  ExtensionTestMessageListener listener_incognito("done_incognito", true);
+
+  const extensions::Extension* extension = LoadExtensionWithFlags(
+      test_data_dir_.AppendASCII("webrequest_reload"),
+      kFlagEnableIncognito);
+  ASSERT_TRUE(extension);
+  ui_test_utils::OpenURLOffTheRecord(browser()->profile(), GURL("about:blank"));
+
+  EXPECT_TRUE(listener.WaitUntilSatisfied());
+  EXPECT_TRUE(listener_incognito.WaitUntilSatisfied());
+
+  // Reload extension and wait for rules to be set up again. This should not
+  // crash the browser.
+  ExtensionTestMessageListener listener2("done", true);
+  ExtensionTestMessageListener listener_incognito2("done_incognito", true);
+
+  ReloadExtension(extension->id());
+
+  EXPECT_TRUE(listener2.WaitUntilSatisfied());
+  EXPECT_TRUE(listener_incognito2.WaitUntilSatisfied());
+}

chrome/browser/extensions/event_router.cc

@@ -257,10 +257,14 @@ void EventRouter::OnListenerRemoved(const EventListener* listener) {
   if (observer != observers_.end())
     observer->second->OnListenerRemoved(details);
 
+  void* profile =
+      listener->process
+          ? Profile::FromBrowserContext(listener->process->GetBrowserContext())
+          : NULL;
   BrowserThread::PostTask(
       BrowserThread::IO, FROM_HERE,
       base::Bind(&NotifyEventListenerRemovedOnIOThread,
-                 profile_, listener->extension_id, event_name));
+                 profile, listener->extension_id, event_name));
 
   const Extension* extension = extensions::ExtensionSystem::Get(profile_)->
       extension_service()->GetExtensionById(listener->extension_id,

chrome/test/data/extensions/api_test/webrequest_reload/background.js

+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+chrome.webRequest.onBeforeRequest.addListener(
+  function(details) {
+  },
+  {
+    urls: [],
+    types: []
+  },
+  []);
+if (chrome.extension.inIncognitoContext)
+  chrome.test.sendMessage("done_incognito");
+else
+  chrome.test.sendMessage("done");

chrome/test/data/extensions/api_test/webrequest_reload/manifest.json

+{
+    "name": "WebRequest + incognito = crash",
+    "incognito":"split",
+    "version": "1",
+    "manifest_version": 2,
+    "background": {
+        "scripts": ["background.js"]
+    },
+    "permissions": [
+        "webRequest",
+        "<all_urls>"
+    ]
+}