Fix crash when closing a window with an associated widget child

Fix crash when closing a window with an associated widget child

This is a similar issue to
https://codereview.chromium.org/1644863003/

When closing some windows, the following occurs:
- WebContentsImpl enters its destructor
- a widget fires OnWidgetDestroying
- an AXWidgetObjWrapper gets destroyed
- WebContentsImpl fires an ax event
- the ax serializer walks the aura window and gets the widget "child" of the aura window
- a new AXWidgetObjWrapper gets created
- the widget's OnWidgetDestroying finishes and widget is destroyed
- WebContentsImpl exits its destructor
- the AXWidgetObjWrapper instance is now wrapping a deallocated widget
- future access to the AXWidgetObjWrapper causes a uaf.

BUG=617020
Committed: https://crrev.com/0ede80c428189d30bb398e351d16217464bd9294
Cr-Commit-Position: refs/heads/master@{#398407}

[David Tseng, 2016-06-07 20:36:36]

Description was changed from

==========
Fix crasher
==========

to

==========
Fix crash when closing a window with an associated widget child

This is a similar issue to
https://codereview.chromium.org/1644863003/

When closing some windows, the following occurs:
- a widget fires OnWidgetDestroying
- an AXWidgetObjWrapper gets destroyed
- the ax serializer walks the aura window and gets the widget "child" of the
aura window
- a new AXWidgetObjWrapper gets created
- the widget's OnWidgetDestroying finishes and widget is destroyed
- the AXWidgetObjWrapper instance is now wrapping a deallocated widget 
- future access to the AXWidgetObjWrapper causes a uaf.

BUG=617020
==========

[David Tseng, 2016-06-07 20:36:37]

dtseng@chromium.org changed reviewers:
+ dmazzoni@chromium.org

[David Tseng, 2016-06-07 20:39:17]

Description was changed from

==========
Fix crash when closing a window with an associated widget child

This is a similar issue to
https://codereview.chromium.org/1644863003/

When closing some windows, the following occurs:
- a widget fires OnWidgetDestroying
- an AXWidgetObjWrapper gets destroyed
- the ax serializer walks the aura window and gets the widget "child" of the
aura window
- a new AXWidgetObjWrapper gets created
- the widget's OnWidgetDestroying finishes and widget is destroyed
- the AXWidgetObjWrapper instance is now wrapping a deallocated widget 
- future access to the AXWidgetObjWrapper causes a uaf.

BUG=617020
==========

to

==========
Fix crash when closing a window with an associated widget child

This is a similar issue to
https://codereview.chromium.org/1644863003/

When closing some windows, the following occurs:
- WebContentsImpl enters its destructor
- a widget fires OnWidgetDestroying
- an AXWidgetObjWrapper gets destroyed
- WebContentsImpl fires an ax event
- the ax serializer walks the aura window and gets the widget "child" of the
aura window
- a new AXWidgetObjWrapper gets created
- the widget's OnWidgetDestroying finishes and widget is destroyed
- WebContentsImpl exits its destructor
- the AXWidgetObjWrapper instance is now wrapping a deallocated widget 
- future access to the AXWidgetObjWrapper causes a uaf.

BUG=617020
==========

[dmazzoni, 2016-06-07 21:54:24]

lgtm

[David Tseng, 2016-06-07 22:01:46]

The CQ bit was checked by dtseng@chromium.org

[commit-bot: I haz the power, 2016-06-07 22:02:24]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2044123003/1

[commit-bot: I haz the power, 2016-06-07 22:50:12]

Description was changed from

==========
Fix crash when closing a window with an associated widget child

This is a similar issue to
https://codereview.chromium.org/1644863003/

When closing some windows, the following occurs:
- WebContentsImpl enters its destructor
- a widget fires OnWidgetDestroying
- an AXWidgetObjWrapper gets destroyed
- WebContentsImpl fires an ax event
- the ax serializer walks the aura window and gets the widget "child" of the
aura window
- a new AXWidgetObjWrapper gets created
- the widget's OnWidgetDestroying finishes and widget is destroyed
- WebContentsImpl exits its destructor
- the AXWidgetObjWrapper instance is now wrapping a deallocated widget 
- future access to the AXWidgetObjWrapper causes a uaf.

BUG=617020
==========

to

==========
Fix crash when closing a window with an associated widget child

This is a similar issue to
https://codereview.chromium.org/1644863003/

When closing some windows, the following occurs:
- WebContentsImpl enters its destructor
- a widget fires OnWidgetDestroying
- an AXWidgetObjWrapper gets destroyed
- WebContentsImpl fires an ax event
- the ax serializer walks the aura window and gets the widget "child" of the
aura window
- a new AXWidgetObjWrapper gets created
- the widget's OnWidgetDestroying finishes and widget is destroyed
- WebContentsImpl exits its destructor
- the AXWidgetObjWrapper instance is now wrapping a deallocated widget 
- future access to the AXWidgetObjWrapper causes a uaf.

BUG=617020
==========

[commit-bot: I haz the power, 2016-06-07 22:50:13]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-06-07 22:53:30]

Description was changed from

==========
Fix crash when closing a window with an associated widget child

This is a similar issue to
https://codereview.chromium.org/1644863003/

When closing some windows, the following occurs:
- WebContentsImpl enters its destructor
- a widget fires OnWidgetDestroying
- an AXWidgetObjWrapper gets destroyed
- WebContentsImpl fires an ax event
- the ax serializer walks the aura window and gets the widget "child" of the
aura window
- a new AXWidgetObjWrapper gets created
- the widget's OnWidgetDestroying finishes and widget is destroyed
- WebContentsImpl exits its destructor
- the AXWidgetObjWrapper instance is now wrapping a deallocated widget 
- future access to the AXWidgetObjWrapper causes a uaf.

BUG=617020
==========

to

==========
Fix crash when closing a window with an associated widget child

This is a similar issue to
https://codereview.chromium.org/1644863003/

When closing some windows, the following occurs:
- WebContentsImpl enters its destructor
- a widget fires OnWidgetDestroying
- an AXWidgetObjWrapper gets destroyed
- WebContentsImpl fires an ax event
- the ax serializer walks the aura window and gets the widget "child" of the
aura window
- a new AXWidgetObjWrapper gets created
- the widget's OnWidgetDestroying finishes and widget is destroyed
- WebContentsImpl exits its destructor
- the AXWidgetObjWrapper instance is now wrapping a deallocated widget
- future access to the AXWidgetObjWrapper causes a uaf.

BUG=617020

Committed: https://crrev.com/0ede80c428189d30bb398e351d16217464bd9294
Cr-Commit-Position: refs/heads/master@{#398407}
==========

[commit-bot: I haz the power, 2016-06-07 22:53:31]

Patchset 1 (id:??) landed as
https://crrev.com/0ede80c428189d30bb398e351d16217464bd9294
Cr-Commit-Position: refs/heads/master@{#398407}