Ensure a guest WebContent's view is removed from the InputEventRouter.

content/browser/web_contents/web_contents_impl.cc

Index: content/browser/web_contents/web_contents_impl.cc
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 956831386b133641428afd818ee075f0ba86cb72..41466816a280a0b99d62363e5f4d6294f8078ebe 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -418,6 +418,19 @@ WebContentsImpl::~WebContentsImpl() {
 
   rwh_input_event_router_.reset();
 
+  // If this WebContents is a guest and goes away before its view has
+  // de-registered its surface id namespace with the outermost WebContent's
+  // input event router (IER), we will lose the ability to ever deregister it,
+  // potentially resulting in a stale pointer in the IER's owner_map_.
+  // Speculative fix for https://crbug.com/570646.
+  auto ier = GetOuterWebContents()
+                 ? GetOuterWebContents()->GetInputEventRouter()
+                 : nullptr;
+  auto rwhvb =

[kenrb, 2015/12/21 21:51:02]

nit: I don't think variable names are supposed to be abbreviated like that under
the style guide.

[wjmaclean, 2015/12/22 12:43:38]

No, probably not ... I was just following other usages of rwhvb in the file.

Done.

+      static_cast<RenderWidgetHostViewBase*>(GetRenderWidgetHostView());
+  if (ier && rwhvb)
+    ier->RemoveSurfaceIdNamespaceOwner(rwhvb->GetSurfaceIdNamespace());
+
   // Delete all RFH pending shutdown, which will lead the corresponding RVH to
   // shutdown and be deleted as well.
   frame_tree_.ForEach(