Fix crash in SiteEngagementServiceHelper when switching render view hosts.

chrome/browser/engagement/site_engagement_service_browsertest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/test/histogram_tester.h"
 #include "base/timer/mock_timer.h"
 #include "base/values.h"
 #include "chrome/browser/engagement/site_engagement_helper.h"
 #include "chrome/browser/engagement/site_engagement_service.h"
@@ skipping 40 matching lines @@
 
   // Set a pause timer on the input tracker for test purposes.
   void SetInputTrackerPauseTimer(SiteEngagementHelper* helper,
                                  scoped_ptr<base::Timer> timer) {
     helper->input_tracker_.SetPauseTimerForTesting(timer.Pass());
   }
 
   bool IsTracking(SiteEngagementHelper* helper) {
     return helper->input_tracker_.is_tracking();
   }
+
+  bool IsActive(SiteEngagementHelper* helper) {
+    return helper->input_tracker_.IsActive();
+  }
+
+  content::RenderViewHost* InputTrackerHost(SiteEngagementHelper* helper) {
+    return helper->input_tracker_.host();
+  }
 };
 
 IN_PROC_BROWSER_TEST_F(SiteEngagementServiceBrowserTest,
                        KeyPressEngagementAccumulation) {
   GURL url1("https://www.google.com/");
   GURL url2("http://www.google.com/");
   content::WebContents* web_contents =
     browser()->tab_strip_model()->GetActiveWebContents();
 
   scoped_ptr<SiteEngagementHelper> helper(CreateHelper(web_contents));
@@ skipping 334 matching lines @@
 
   base::MockTimer* input_tracker_timer = new base::MockTimer(true, false);
   scoped_ptr<SiteEngagementHelper> helper(CreateHelper(web_contents));
   SetInputTrackerPauseTimer(helper.get(), make_scoped_ptr(input_tracker_timer));
 
   // Navigation starts the initial delay timer.
   ui_test_utils::NavigateToURL(browser(), url1);
   EXPECT_TRUE(input_tracker_timer->IsRunning());
   EXPECT_FALSE(IsTracking(helper.get()));
 
-  content::RenderViewHost* rvh = web_contents->GetRenderViewHost();
+  content::RenderViewHost* rvh1 = web_contents->GetRenderViewHost();
+
+  ui_test_utils::NavigateToURLWithDisposition(
+      browser(), url2, NEW_BACKGROUND_TAB,
+      ui_test_utils::BROWSER_TEST_WAIT_FOR_NAVIGATION);
+  content::RenderViewHost* rvh2 =
+      browser()->tab_strip_model()->GetWebContentsAt(1)->GetRenderViewHost();
 
   // The timer should still be running after the RenderViewHost is changed.
-  helper->RenderViewHostChanged(rvh, rvh);
+  helper->RenderViewHostChanged(rvh1, rvh2);
   EXPECT_TRUE(input_tracker_timer->IsRunning());
   EXPECT_FALSE(IsTracking(helper.get()));
+  EXPECT_EQ(rvh2, InputTrackerHost(helper.get()));
 
   // Firing the timer should add the callbacks.
   input_tracker_timer->Fire();
   EXPECT_FALSE(input_tracker_timer->IsRunning());
   EXPECT_TRUE(IsTracking(helper.get()));
 
   // The callbacks should be on readded another RVH change since the timer has
   // already fired.
-  helper->RenderViewHostChanged(rvh, rvh);
+  helper->RenderViewHostChanged(rvh2, rvh1);
   EXPECT_FALSE(input_tracker_timer->IsRunning());
   EXPECT_TRUE(IsTracking(helper.get()));
+  EXPECT_EQ(rvh1, InputTrackerHost(helper.get()));
 
   // Ensure nothing bad happens with a destroyed RVH.
-  helper->RenderViewHostChanged(nullptr, rvh);
+  helper->RenderViewHostChanged(nullptr, rvh2);
   EXPECT_FALSE(input_tracker_timer->IsRunning());
   EXPECT_TRUE(IsTracking(helper.get()));
+  EXPECT_EQ(rvh2, InputTrackerHost(helper.get()));
 
   // Ensure nothing happens when RVH change happens for a hidden tab.
   helper->WasHidden();
   EXPECT_FALSE(input_tracker_timer->IsRunning());
   EXPECT_FALSE(IsTracking(helper.get()));
 
-  helper->RenderViewHostChanged(nullptr, rvh);
+  helper->RenderViewHostChanged(rvh2, rvh1);
   EXPECT_FALSE(input_tracker_timer->IsRunning());
   EXPECT_FALSE(IsTracking(helper.get()));
+  EXPECT_EQ(nullptr, InputTrackerHost(helper.get()));
 }