Extract WebFrameClient implementation out of WebTestProxyBase.

components/test_runner/mock_color_chooser.cc

Index: components/test_runner/mock_color_chooser.cc
diff --git a/components/test_runner/mock_color_chooser.cc b/components/test_runner/mock_color_chooser.cc
index 55d586b3580f82a2fe62b5df7eeaf8d4e89c965d..f56bbfa5eb5dd0610c173d98f4e3c6fc5226f101 100644
--- a/components/test_runner/mock_color_chooser.cc
+++ b/components/test_runner/mock_color_chooser.cc
@@ -4,6 +4,7 @@
 
 #include "components/test_runner/mock_color_chooser.h"
 
+#include "components/test_runner/test_runner.h"
 #include "components/test_runner/web_test_delegate.h"
 #include "components/test_runner/web_test_proxy.h"
 
@@ -27,26 +28,28 @@ class HostMethodTask : public WebMethodTask<MockColorChooser> {
 
 MockColorChooser::MockColorChooser(blink::WebColorChooserClient* client,
                                    WebTestDelegate* delegate,
-                                   WebTestProxyBase* proxy)
-    : client_(client),
-      delegate_(delegate),
-      proxy_(proxy) {
-  proxy_->DidOpenChooser();
+                                   TestRunner* test_runner)
+    : client_(client), delegate_(delegate), test_runner_(test_runner) {
+  test_runner_->DidOpenChooser();
 }
 
 MockColorChooser::~MockColorChooser() {
-  proxy_->DidCloseChooser();
+  test_runner_->DidCloseChooser();
 }
 
 void MockColorChooser::setSelectedColor(const blink::WebColor color) {}
 
 void MockColorChooser::endChooser() {
+  DCHECK(client_);
+  DCHECK(delegate_);
   delegate_->PostDelayedTask(
       new HostMethodTask(this, &MockColorChooser::InvokeDidEndChooser), 0);
+  delegate_ = nullptr;
 }
 
 void MockColorChooser::InvokeDidEndChooser() {
   client_->didEndChooser();
+  client_ = nullptr;

[kochi, 2016/03/31 08:14:34]

I'm seeing this line is causing a use-after-free.

crash log for unknown process name (pid <unknown>):
STDOUT: PASS testRunner.isChooserShown() is false
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS testRunner.isChooserShown() is true
STDOUT: PASS successfullyParsed is true
STDOUT: 
STDOUT: TEST COMPLETE
STDOUT: 
STDERR: OUTPUT CONTAINS "AddressSanitizer", so we are treating this test as if
it crashed, even though it did not.
STDERR: 
STDERR: =================================================================
STDERR: ==11084==ERROR: AddressSanitizer: heap-use-after-free on address
0x60600015d588 at pc 0x7f740913491a bp 0x7ffd3dc75750 sp 0x7ffd3dc75748
STDERR: WRITE of size 8 at 0x60600015d588 thread T0 (content_shell)
STDERR:     #0 0x7f7409134919 in ??
./out/Default/../../components/test_runner/mock_color_chooser.cc:52:11
STDERR:     #1 0x7f7409134d36 in ??
./out/Default/../../components/test_runner/mock_color_chooser.cc:21:32
STDERR:     #2 0x7f7409134f84 in ??
./out/Default/../../components/test_runner/web_task.h:61:7

 }
 
 }  // namespace test_runner