bluetooth: Don't call methods of WebContentsImpl while it's being destroyed.

content/browser/bluetooth/frame_connected_bluetooth_devices_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/bluetooth/frame_connected_bluetooth_devices.h"
 
 #include "base/memory/ptr_util.h"
 #include "base/memory/ref_counted.h"
 #include "content/test/test_render_view_host.h"
 #include "content/test/test_web_contents.h"
@@ skipping 336 matching lines @@
   map0_.reset();
 
   // WebContents should still be connected because of map1_.
   EXPECT_TRUE(contents()->IsConnectedToBluetoothDevice());
 
   map1_.reset();
 
   EXPECT_FALSE(contents()->IsConnectedToBluetoothDevice());
 }
 
+TEST_F(FrameConnectedBluetoothDevicesTest,
+       DestroyedByWebContentsImplDestruction) {
+  // Tests that we don't crash when FrameConnectedBluetoothDevices contains
+  // at least one device, and it is destroyed while WebContentsImpl is being
+  // destroyed.
+
+  map0_->Insert(kDeviceId0, GetConnection(kDeviceAddress0));
+  // A FrameConnectedBluetoothDevices instance is usually owned by a
+  // WebBluetoothServiceImpl instance which is owned by a RenderFrameHost which
+  // is owned by WebContentsImpl. In order to avoid adding unnecessary
+  // complexity to WebBluetoothServiceImpl just so we can perform this test we
+  // add the map directly to a frame and then delete WebContents.
+  contents()->GetMainFrame()->SetFrameConnectedBluetoothDevices(
+      std::move(map0_));
+  DeleteContents();
+}
+
 }  // namespace content