Fix crash when destroying a RenderWidgetHost that holds the pointer

chrome/browser/site_per_process_interactive_browsertest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/strings/string_number_conversions.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/exclusive_access/fullscreen_controller_test.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
@@ skipping 723 matching lines @@
   // Verify that all fullscreen styles have been cleared.
   EXPECT_FALSE(ElementHasFullscreenStyle(a_top, "child-0"));
   EXPECT_FALSE(ElementHasFullscreenStyle(a_bottom, "child-0"));
   EXPECT_FALSE(ElementHasFullscreenStyle(a_bottom, "child-1"));
   EXPECT_FALSE(ElementHasFullscreenStyle(b_second, "child-0"));
   EXPECT_FALSE(ElementHasFullscreenStyle(c_top, "child-0"));
   EXPECT_FALSE(ElementHasFullscreenStyle(c_middle, "fullscreen-div"));
   EXPECT_FALSE(ElementHasFullscreenStyle(c_middle, "child-0"));
 }
 
+IN_PROC_BROWSER_TEST_F(SitePerProcessInteractiveBrowserTest,
+                       RenderWidgetHostDeletedWhileMouseLocked) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  ui_test_utils::NavigateToURL(browser(), main_url);
+
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  content::RenderFrameHost* main_frame = web_contents->GetMainFrame();
+  content::RenderFrameHost* child = ChildFrameAt(main_frame, 0);
+
+  EXPECT_TRUE(ExecuteScript(child, "document.body.requestPointerLock()"));
+  bool mouse_locked = false;
+  EXPECT_TRUE(ExecuteScriptAndExtractBool(child,
+                                          "window.domAutomationController.send("
+                                          "document.body == "
+                                          "document.pointerLockElement)",
+                                          &mouse_locked));
+  EXPECT_TRUE(mouse_locked);
+
+  EXPECT_TRUE(ExecuteScript(main_frame,
+                            "document.querySelector('iframe').parentNode."
+                            "removeChild(document.querySelector('iframe'))"));

[Charlie Reis, 2016/07/07 21:47:13]

Maybe it's worth adding a comment that this used to crash due to
https://crbug.com/619571.

Also, is it useful to check mouse_locked again after this?

[lfg, 2016/07/11 19:11:29]

Done.
Done.

+}