Don't call through stale pointers in the "hung page" dialog.

While the "hung page" dialog is up, the [X] button has the same
effect as the "Wait" button. However, when the hung process goes
away, the "hung page" dialog tries to silently close itself with
no effect, but calling Close() on itself ends up calling through
to the function handling the [X] button, which tries to take an
action on a dead process.

The "hung page" dialog closes itself, without taking any action,
in two cases. The first case was when the render process became
responsive again. In that case, internal pointers were nulled out
so that no action would be taken when the dialog closed. This is
the second case, where the process died for other reasons. In
this case too, now, the internal pointers are nulled out to ensure
no action (and no crash).

BUG=810750

Change-Id: Ifc65c44003457fba87abf1e9977cdfe4218af168
Reviewed-on: https://chromium-review.googlesource.com/911729
Commit-Queue: Avi Drissman <avi@chromium.org>
Reviewed-by: Bret Sepulveda <bsep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#535915}

chrome/browser/ui/views/hung_renderer_view.cc

@@ -194,7 +194,7 @@ HungRendererDialogView* HungRendererDialogView::Create(
     gfx::NativeWindow context) {
   if (!g_instance_) {
     g_instance_ = new HungRendererDialogView;
-    views::DialogDelegate::CreateDialogWidget(g_instance_, context, NULL);
+    views::DialogDelegate::CreateDialogWidget(g_instance_, context, nullptr);
   }
   return g_instance_;
 }
@@ -248,7 +248,7 @@ HungRendererDialogView::HungRendererDialogView()
 }
 
 HungRendererDialogView::~HungRendererDialogView() {
-  hung_pages_table_->SetModel(NULL);
+  hung_pages_table_->SetModel(nullptr);
 }
 
 void HungRendererDialogView::ShowForWebContents(
@@ -309,10 +309,7 @@ void HungRendererDialogView::EndForWebContents(
   DCHECK(contents);
   if (hung_pages_table_model_->RowCount() == 0 ||
       hung_pages_table_model_->GetRenderWidgetHost() == render_widget_host) {
-    GetWidget()->Close();
-    // Close is async, make sure we drop our references to the tab immediately
-    // (it may be going away).
-    hung_pages_table_model_->InitForWebContents(nullptr, nullptr);
+    CloseDialogWithNoAction();
   }
 }
 
@@ -334,7 +331,7 @@ bool HungRendererDialogView::ShouldShowCloseButton() const {
 
 void HungRendererDialogView::WindowClosing() {
   // We are going to be deleted soon, so make sure our instance is destroyed.
-  g_instance_ = NULL;
+  g_instance_ = nullptr;
 }
 
 int HungRendererDialogView::GetDialogButtons() const {
@@ -398,7 +395,7 @@ void HungRendererDialogView::TabUpdated() {
 }
 
 void HungRendererDialogView::TabDestroyed() {
-  GetWidget()->Close();
+  CloseDialogWithNoAction();
 }
 
 ///////////////////////////////////////////////////////////////////////////////
@@ -465,3 +462,12 @@ void HungRendererDialogView::UpdateLabels() {
   // Update the "Exit" button.
   DialogModelChanged();
 }
+
+void HungRendererDialogView::CloseDialogWithNoAction() {
+  // Drop references to the tab immediately because
+  // - Close is async and we don't want hanging references, and
+  // - While the dialog is active, [X] maps to restarting the hang timer, but
+  //   while closing we don't want that action.
+  hung_pages_table_model_->InitForWebContents(nullptr, nullptr);
+  GetWidget()->Close();
+}

chrome/browser/ui/views/hung_renderer_view.h

@@ -169,6 +169,8 @@ class HungRendererDialogView : public views::DialogDelegateView,
 
   void UpdateLabels();
 
+  void CloseDialogWithNoAction();
+
   // The label describing the list.
   views::Label* info_label_;