Only the root BrowserAccessibilityManager should destroy the java obj.

Only the root BrowserAccessibilityManager should destroy the java obj.

Ever since http://crrev.com/380416 we have multiple accessibility trees
in C++, one for each frame - but we only have one Java
BrowserAccessibilityManager object.

We were incorrectly calling onNativeObjectDestroyed when any accessibility
tree was destroyed, instead of only when the root tree was destroyed.
That gave the Java obj a null mNativeObj and led to crashes.

This change fixes this by having onNativeObjectDestroyed take an argument
so that the right pointer is the one that's cleared - only the one on the
root frame. It also adds checks to all of the Java functions called
by native code so that mNativeObj being null can't lead to a crash again.

BUG=595426
Committed: https://crrev.com/83b8b4b78472c6b67319367393b8b865efdc8c47
Cr-Commit-Position: refs/heads/master@{#382145}

[dmazzoni, 2016-03-18 21:43:31]

dmazzoni@chromium.org changed reviewers:
+ dtseng@chromium.org

[David Tseng, 2016-03-18 23:31:29]

lgtm

[dmazzoni, 2016-03-18 23:49:08]

The CQ bit was checked by dmazzoni@chromium.org

[commit-bot: I haz the power, 2016-03-18 23:49:33]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1820473003/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1820473003/1

[commit-bot: I haz the power, 2016-03-19 00:36:12]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-03-19 00:37:15]

Description was changed from

==========
Only the root BrowserAccessibilityManager should destroy the java obj.

Ever since http://crrev.com/380416 we have multiple accessibility trees
in C++, one for each frame - but we only have one Java
BrowserAccessibilityManager object.

We were incorrectly calling onNativeObjectDestroyed when any accessibility
tree was destroyed, instead of only when the root tree was destroyed.
That gave the Java obj a null mNativeObj and led to crashes.

This change fixes this by having onNativeObjectDestroyed take an argument
so that the right pointer is the one that's cleared - only the one on the
root frame. It also adds checks to all of the Java functions called
by native code so that mNativeObj being null can't lead to a crash again.

BUG=595426
==========

to

==========
Only the root BrowserAccessibilityManager should destroy the java obj.

Ever since http://crrev.com/380416 we have multiple accessibility trees
in C++, one for each frame - but we only have one Java
BrowserAccessibilityManager object.

We were incorrectly calling onNativeObjectDestroyed when any accessibility
tree was destroyed, instead of only when the root tree was destroyed.
That gave the Java obj a null mNativeObj and led to crashes.

This change fixes this by having onNativeObjectDestroyed take an argument
so that the right pointer is the one that's cleared - only the one on the
root frame. It also adds checks to all of the Java functions called
by native code so that mNativeObj being null can't lead to a crash again.

BUG=595426

Committed: https://crrev.com/83b8b4b78472c6b67319367393b8b865efdc8c47
Cr-Commit-Position: refs/heads/master@{#382145}
==========

[commit-bot: I haz the power, 2016-03-19 00:37:15]

Patchset 1 (id:??) landed as
https://crrev.com/83b8b4b78472c6b67319367393b8b865efdc8c47
Cr-Commit-Position: refs/heads/master@{#382145}