Extract WebFrameClient implementation out of WebTestProxyBase.

components/test_runner/mock_color_chooser.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/test_runner/mock_color_chooser.h"
 
+#include "components/test_runner/test_runner.h"
 #include "components/test_runner/web_test_delegate.h"
 #include "components/test_runner/web_test_proxy.h"
 
 namespace test_runner {
 
 namespace {
 class HostMethodTask : public WebMethodTask<MockColorChooser> {
  public:
   typedef void (MockColorChooser::*CallbackMethodType)();
   HostMethodTask(MockColorChooser* object, CallbackMethodType callback)
       : WebMethodTask<MockColorChooser>(object),
         callback_(callback) {}
 
   void RunIfValid() override { (object_->*callback_)(); }
 
  private:
   CallbackMethodType callback_;
 };
 
 } // namespace
 
 MockColorChooser::MockColorChooser(blink::WebColorChooserClient* client,
                                    WebTestDelegate* delegate,
-                                   WebTestProxyBase* proxy)
-    : client_(client),
-      delegate_(delegate),
-      proxy_(proxy) {
-  proxy_->DidOpenChooser();
+                                   TestRunner* test_runner)
+    : client_(client), delegate_(delegate), test_runner_(test_runner) {
+  test_runner_->DidOpenChooser();
 }
 
 MockColorChooser::~MockColorChooser() {
-  proxy_->DidCloseChooser();
+  test_runner_->DidCloseChooser();
 }
 
 void MockColorChooser::setSelectedColor(const blink::WebColor color) {}
 
 void MockColorChooser::endChooser() {
+  DCHECK(client_);
+  DCHECK(delegate_);
   delegate_->PostDelayedTask(
       new HostMethodTask(this, &MockColorChooser::InvokeDidEndChooser), 0);
+  delegate_ = nullptr;
 }
 
 void MockColorChooser::InvokeDidEndChooser() {
   client_->didEndChooser();
+  client_ = nullptr;

[kochi, 2016/03/31 08:14:34]

I'm seeing this line is causing a use-after-free.

crash log for unknown process name (pid <unknown>):
STDOUT: PASS testRunner.isChooserShown() is false
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS successfullyParsed is true
STDOUT: 
STDOUT: TEST COMPLETE
STDOUT: 
STDERR: OUTPUT CONTAINS "AddressSanitizer", so we are treating this test as if
it crashed, even though it did not.
STDERR: 
STDERR: =================================================================
STDERR: ==11084==ERROR: AddressSanitizer: heap-use-after-free on address
0x60600015d588 at pc 0x7f740913491a bp 0x7ffd3dc75750 sp 0x7ffd3dc75748
STDERR: WRITE of size 8 at 0x60600015d588 thread T0 (content_shell)
STDERR:     #0 0x7f7409134919 in ??
./out/Default/../../components/test_runner/mock_color_chooser.cc:52:11
STDERR:     #1 0x7f7409134d36 in ??
./out/Default/../../components/test_runner/mock_color_chooser.cc:21:32
STDERR:     #2 0x7f7409134f84 in ??
./out/Default/../../components/test_runner/web_task.h:61:7

 }
 
 }  // namespace test_runner