MainFrameObserver is inline owned, so it shouldn't be freed by OnDestruct

MainFrameObserver is inline owned, so it shouldn't be freed by OnDestruct

MainFrameObserver is a RenderFrameObserver and as such is destroyed when
RenderFrame goes away. This happens as part of
RenderFrameObserver::OnDestruct. MainFrameObserver though is inline owned
by WebUIMojo and can be deleted before WebUIMojo is deleted. It results in
use-after-free when WebUIMojo is destructed and tries to free the already
freed MainFrameObserver.

This CL overrides OnDestruct, which allows the MainFrameObserver to stay
alive and be cleaned up by WebUIMojo.

BUG=357747
Committed: https://crrev.com/63b8975f954f2e10ee8c1b339c00b2b252f46132
Cr-Commit-Position: refs/heads/master@{#328990}

[nasko, 2015-05-07 21:36:31]

nasko@chromium.org changed reviewers:
+ sky@chromium.org

[nasko, 2015-05-07 21:36:31]

Hey sky@,
Can you review this CL for me? It is a simple piece from a bigger work I'm doing
- prepping Chrome for removing the concept of swapped-out state.
Thanks in advance!
Nasko

[sky, 2015-05-08 15:16:50]

I'm not an owner of content.

[nasko, 2015-05-08 15:54:36]

On 2015/05/08 15:16:50, sky wrote:
> I'm not an owner of content.

I included you as you have modified this file quite a bit. I'm a content owner,
so that would be fine, looking for a reviewer with knowledge of the code to
confirm my fix.

[sky, 2015-05-08 16:28:39]

LGTM with the following change

https://codereview.chromium.org/1137533002/diff/1/content/renderer/web_ui_mojo.h
File content/renderer/web_ui_mojo.h (right):

https://codereview.chromium.org/1137533002/diff/1/content/renderer/web_ui_moj...
content/renderer/web_ui_mojo.h:43: void OnDestruct() override {}
Style guide says we shouldn't inline this, also, it would be good to add the
comment you have in the description as to why this does nothing.

[nasko, 2015-05-08 17:28:50]

https://codereview.chromium.org/1137533002/diff/1/content/renderer/web_ui_mojo.h
File content/renderer/web_ui_mojo.h (right):

https://codereview.chromium.org/1137533002/diff/1/content/renderer/web_ui_moj...
content/renderer/web_ui_mojo.h:43: void OnDestruct() override {}
On 2015/05/08 16:28:38, sky wrote:
> Style guide says we shouldn't inline this, also, it would be good to add the
> comment you have in the description as to why this does nothing.

Done.

[nasko, 2015-05-08 17:28:57]

The CQ bit was checked by nasko@chromium.org

[nasko, 2015-05-08 17:28:57]

The patchset sent to the CQ was uploaded after l-g-t-m from sky@chromium.org
Link to the patchset: https://codereview.chromium.org/1137533002/#ps20001
(title: "Address comments by sky@.")

[commit-bot: I haz the power, 2015-05-08 17:30:25]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1137533002/20001

[commit-bot: I haz the power, 2015-05-08 18:23:15]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-05-08 18:24:07]

Patchset 2 (id:??) landed as
https://crrev.com/63b8975f954f2e10ee8c1b339c00b2b252f46132
Cr-Commit-Position: refs/heads/master@{#328990}