bluetooth: Don't call methods of WebContentsImpl while it's being destroyed.

content/browser/bluetooth/frame_connected_bluetooth_devices_unittest.cc

Index: content/browser/bluetooth/frame_connected_bluetooth_devices_unittest.cc
diff --git a/content/browser/bluetooth/frame_connected_bluetooth_devices_unittest.cc b/content/browser/bluetooth/frame_connected_bluetooth_devices_unittest.cc
index 8a76e565ece2ceb803e3735b600ea634bcf18f3c..339f8806b518f129cf68f37ea44a78f353d357ed 100644
--- a/content/browser/bluetooth/frame_connected_bluetooth_devices_unittest.cc
+++ b/content/browser/bluetooth/frame_connected_bluetooth_devices_unittest.cc
@@ -354,4 +354,21 @@ TEST_F(FrameConnectedBluetoothDevicesTest, Destruction_MultipleMaps) {
   EXPECT_FALSE(contents()->IsConnectedToBluetoothDevice());
 }
 
+TEST_F(FrameConnectedBluetoothDevicesTest,
+       DestroyedByWebContentsImplDestruction) {
+  // Tests that we don't crash when FrameConnectedBluetoothDevices contains
+  // at least one device, and it is destroyed while WebContentsImpl is being
+  // destroyed.
+
+  map0_->Insert(kDeviceId0, GetConnection(kDeviceAddress0));
+  // A FrameConnectedBluetoothDevices instance is usually owned by a
+  // WebBluetoothServiceImpl instance which is owned by a RenderFrameHost which
+  // is owned by WebContentsImpl. In order to avoid adding unnecessary
+  // complexity to WebBluetoothServiceImpl just so we can perform this test we
+  // add the map directly to a frame and then delete WebContents.
+  contents()->GetMainFrame()->SetFrameConnectedBluetoothDevices(
+      std::move(map0_));
+  DeleteContents();
+}
+
 }  // namespace content