Fix crash when destroying a RenderWidgetHost that holds the pointer

chrome/browser/site_per_process_interactive_browsertest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/strings/string_number_conversions.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/exclusive_access/fullscreen_controller_test.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
@@ skipping 723 matching lines @@
   // Verify that all fullscreen styles have been cleared.
   EXPECT_FALSE(ElementHasFullscreenStyle(a_top, "child-0"));
   EXPECT_FALSE(ElementHasFullscreenStyle(a_bottom, "child-0"));
   EXPECT_FALSE(ElementHasFullscreenStyle(a_bottom, "child-1"));
   EXPECT_FALSE(ElementHasFullscreenStyle(b_second, "child-0"));
   EXPECT_FALSE(ElementHasFullscreenStyle(c_top, "child-0"));
   EXPECT_FALSE(ElementHasFullscreenStyle(c_middle, "fullscreen-div"));
   EXPECT_FALSE(ElementHasFullscreenStyle(c_middle, "child-0"));
 }
 
+// Test that deleting a RenderWidgetHost that holds the mouse lock won't cause a
+// crash. https://crbug.com/619571.
+IN_PROC_BROWSER_TEST_F(SitePerProcessInteractiveBrowserTest,
+                       RenderWidgetHostDeletedWhileMouseLocked) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  ui_test_utils::NavigateToURL(browser(), main_url);
+
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  content::RenderFrameHost* main_frame = web_contents->GetMainFrame();
+  content::RenderFrameHost* child = ChildFrameAt(main_frame, 0);
+
+  EXPECT_TRUE(ExecuteScript(child, "document.body.requestPointerLock()"));
+  bool mouse_locked = false;
+  EXPECT_TRUE(ExecuteScriptAndExtractBool(child,
+                                          "window.domAutomationController.send("
+                                          "document.body == "
+                                          "document.pointerLockElement)",
+                                          &mouse_locked));
+  EXPECT_TRUE(mouse_locked);
+  EXPECT_TRUE(main_frame->GetView()->IsMouseLocked());
+
+  EXPECT_TRUE(ExecuteScript(main_frame,
+                            "document.querySelector('iframe').parentNode."
+                            "removeChild(document.querySelector('iframe'))"));
+  EXPECT_FALSE(main_frame->GetView()->IsMouseLocked());
+}