Fix crash when destroying a RenderWidgetHost that holds the pointer

content/browser/frame_host/render_widget_host_view_child_frame.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_widget_host_view_child_frame.h"
 
 #include <algorithm>
 #include <utility>
 #include <vector>
 
@@ skipping 59 matching lines @@
     if (parent_surface_id_namespace_) {
       GetSurfaceManager()->UnregisterSurfaceNamespaceHierarchy(
           parent_surface_id_namespace_, GetSurfaceIdNamespace());
     }
     // Unregister the client here, as it is not guaranteed in tests that the
     // destructor will be called.
     GetSurfaceManager()->UnregisterSurfaceFactoryClient(
         id_allocator_->id_namespace());
 
     parent_surface_id_namespace_ = 0;
+
+    // Unlocks the mouse if this RenderWidgetHostView holds the lock.
+    UnlockMouse();

[Charlie Reis, 2016/07/06 17:41:47]

This seems a bit random to me.  I wouldn't expect this method to have a bunch of
feature-specific reset code here, or if it did, there would likely be more than
just mouse lock.  Is there a more general place that should trigger this?  If
not, can you add a comment about what sorts of things need resetting when the
frame connector changes?

[lfg, 2016/07/07 20:17:35]

For both Aura and Mac, this cleanup happens in the destructor. The problem in
RWHVChildFrame, is that after it loses the CrossProcessFrameConnector there's no
way to walk the frame tree anymore, so I thought this was the next best place to
have the cleanup. I think the option to unlock it in the destructor would be
possible by using a virtual in RWHDelegate, and do the unlock through
WebContents, but that seems like a much worse option than doing it here (since
we would have to add a bunch of code to RenderWidgetHost that's specific to the
child frame case).

I'll add a comment about cleaning up things that need to walk the frame tree.

[Charlie Reis, 2016/07/07 21:47:12]

Acknowledged.

   }
   frame_connector_ = frame_connector;
   if (frame_connector_) {
     GetSurfaceManager()->RegisterSurfaceFactoryClient(
         id_allocator_->id_namespace(), this);
     RenderWidgetHostViewBase* parent_view =
         frame_connector_->GetParentRenderWidgetHostView();
     if (parent_view) {
       parent_surface_id_namespace_ = parent_view->GetSurfaceIdNamespace();
       DCHECK_NE(parent_surface_id_namespace_, 0u);
@@ skipping 378 matching lines @@
   frame_connector_->ForwardProcessAckedTouchEvent(touch, ack_result);
 }
 
 bool RenderWidgetHostViewChildFrame::LockMouse() {
   if (frame_connector_)
     return frame_connector_->LockMouse();
   return false;
 }
 
 void RenderWidgetHostViewChildFrame::UnlockMouse() {
+  if (host_->delegate() && host_->delegate()->HasMouseLock(host_) &&
+      frame_connector_)
+    frame_connector_->UnlockMouse();
 }
 
 bool RenderWidgetHostViewChildFrame::IsMouseLocked() {
-  if (!frame_connector_)
+  if (!host_->delegate())
     return false;
 
-  RenderWidgetHostViewBase* root_view =
-      frame_connector_->GetRootRenderWidgetHostView();
-
-  if (root_view)
-    return root_view->IsMouseLocked();
-
-  return false;
+  return host_->delegate()->HasMouseLock(host_);
 }
 
 uint32_t RenderWidgetHostViewChildFrame::GetSurfaceIdNamespace() {
   return id_allocator_->id_namespace();
 }
 
 void RenderWidgetHostViewChildFrame::ProcessKeyboardEvent(
     const NativeWebKeyboardEvent& event) {
   host_->ForwardKeyboardEvent(event);
 }
@@ skipping 193 matching lines @@
 
 bool RenderWidgetHostViewChildFrame::IsChildFrameForTesting() const {
   return true;
 }
 
 cc::SurfaceId RenderWidgetHostViewChildFrame::SurfaceIdForTesting() const {
   return surface_id_;
 };
 
 }  // namespace content