Reset Text Input State for RenderWidgetHostView before RenderWidgetHost Detaches from Delegate

content/browser/browser_plugin/browser_plugin_guest.cc

Index: content/browser/browser_plugin/browser_plugin_guest.cc
diff --git a/content/browser/browser_plugin/browser_plugin_guest.cc b/content/browser/browser_plugin/browser_plugin_guest.cc
index fa72b21111d79b812cf51ec14641554bb08f35bb..41a9f1bff636b6e06a759d53639d53d841df9db2 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.cc
+++ b/content/browser/browser_plugin/browser_plugin_guest.cc
@@ -36,6 +36,7 @@
 #include "content/common/host_shared_bitmap_manager.h"
 #include "content/common/input_messages.h"
 #include "content/common/site_isolation_policy.h"
+#include "content/common/text_input_state.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_plugin_guest_manager.h"
@@ -776,6 +777,11 @@ void BrowserPluginGuest::OnDetach(int browser_plugin_instance_id) {
   if (!attached())
     return;
 
+  // The BrowserPluginGuest loses the link to |owner_web_contents_|. Therefore,
+  // the RenderWidgetHostViewGuest will not get a chance to update its text
+  // input state which is tracked by |owner_web_contents_| (crbug.com/602144).

[EhsanK, 2016/04/11 21:59:18]

Beyond this point, |attached_ = false| and hence,
|BrowserPluginGuest::owner_web_contents()| return null which breaks the link to
the outer WebContents from the inner WebContents. Therefore, this seems to be
the only place we can call this cleanup.

[Charlie Reis, 2016/04/11 22:18:16]

Ok, I'll defer to lazyboy@ here.

+  OnTextInputStateChanged(TextInputState());

[Charlie Reis, 2016/04/11 20:24:52]

This wasn't in patch set 1.  Is it also needed to fix the bug?

[EhsanK, 2016/04/11 21:59:17]

Yes. I have added some comments to crbug.com/602144 regarding this. This is
another case where the destruction of WebContentsImpl does not allow the
RenderWidgetHostView(Guest) to reset the state.

[Charlie Reis, 2016/04/11 22:18:16]

Acknowledged.

+
   // This tells BrowserPluginGuest to queue up all IPCs to BrowserPlugin until
   // it's attached again.
   attached_ = false;