Fix a race condition when an IconAnimation is still running at browser shutdown.

chrome/common/extensions/extension_action.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_COMMON_EXTENSIONS_EXTENSION_ACTION_H_
 #define CHROME_COMMON_EXTENSIONS_EXTENSION_ACTION_H_
 
 #include <map>
 #include <string>
 #include <vector>
@@ skipping 217 matching lines @@
   void PaintBadge(gfx::Canvas* canvas, const gfx::Rect& bounds, int tab_id);
 
   // Gets a weak reference to the icon animation for a tab, if any. The
   // reference will only have a value while the animation is running.
   base::WeakPtr<IconAnimation> GetIconAnimation(int tab_id) const;
 
   // Runs an animation on a tab.
   void RunIconAnimation(int tab_id);
 
  private:
+  class IconAnimationWrapper;
+
+  // Finds the icon animation wrapper for a tab, if any.  If the animation for
+  // this tab has recently completed, also removes up any other dead wrappers
+  // from the map.
+  IconAnimationWrapper* GetIconAnimationWrapper(int tab_id) const;
+
   // If the icon animation is running on tab |tab_id|, applies it to
   // |orig| and returns the result. Otherwise, just returns |orig|.
   gfx::Image ApplyIconAnimation(int tab_id, const gfx::Image& orig) const;
 
   template <class T>
   struct ValueTraits {
     static T CreateEmpty() {
       return T();
     }
   };
@@ skipping 24 matching lines @@
   // kDefaultTabId), or tab-specific state (stored with the tab_id as the key).
   std::map<int, GURL> popup_url_;
   std::map<int, std::string> title_;
   std::map<int, gfx::Image> icon_;
   std::map<int, int> icon_index_;  // index into icon_paths_
   std::map<int, std::string> badge_text_;
   std::map<int, SkColor> badge_background_color_;
   std::map<int, SkColor> badge_text_color_;
   std::map<int, bool> visible_;
 
-  class IconAnimationWrapper;
-  std::map<int, linked_ptr<IconAnimationWrapper> > icon_animation_;
+  // IconAnimationWrappers own themselves so that even if the Extension and
+  // ExtensionAction are destroyed on a non-UI thread, the animation will still
+  // only be touched from the UI thread.  When an animation finishes, it deletes
+  // itself, which causes the WeakPtr in this map to become NULL.
+  // GetIconAnimationWrapper() removes NULLs to prevent the map from growing
+  // without bound.
+  mutable std::map<int, base::WeakPtr<IconAnimationWrapper> > icon_animation_;
 
   std::string default_icon_path_;
 
   // The id for the ExtensionAction, for example: "RssPageAction". This is
   // needed for compat with an older version of the page actions API.
   std::string id_;
 
   // A list of paths to icons this action might show. This is needed to support
   // the legacy setIcon({iconIndex:...} method of the page actions API.
   std::vector<std::string> icon_paths_;
 
   // Saves the arguments from CacheIcon() calls.
   std::map<std::string, gfx::Image> path_to_icon_cache_;
 
   DISALLOW_COPY_AND_ASSIGN(ExtensionAction);
 };
 
 template<>
 struct ExtensionAction::ValueTraits<int> {
   static int CreateEmpty() {
     return -1;
   }
 };
 
 #endif  // CHROME_COMMON_EXTENSIONS_EXTENSION_ACTION_H_