DescriptionFix crash when DecrementCapturerCount() makes a delayed WasHidden() call during WebContentsImpl destruction.
Two parts:
1. WebContentsImpl::DecrementCapturerCount() will restore the true "WasHidden" status of the RenderWidgetHost once the counter reaches zero. However, DecrementCapturerCount() can be called [indirectly] from the WebContentsImpl destructor. In this case, it should not attempt to change/notify anything.
2. It's possible for ThumbnailTabHelper::WidgetHidden() to call ThumbnailTabHelper::UpdateThumbnailIfNecessary() with a NULL pointer. Added a NULL check.
BUG=175275, 130097
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=181876
Patch Set 1 : #
Messages
Total messages: 6 (0 generated)
|