Fix crash when destroying a RenderWidgetHost that holds the pointer

content/browser/frame_host/render_widget_host_view_child_frame.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_widget_host_view_child_frame.h"
 
 #include <algorithm>
 #include <utility>
 #include <vector>
 
@@ skipping 59 matching lines @@
     if (parent_surface_id_namespace_) {
       GetSurfaceManager()->UnregisterSurfaceNamespaceHierarchy(
           parent_surface_id_namespace_, GetSurfaceIdNamespace());
     }
     // Unregister the client here, as it is not guaranteed in tests that the
     // destructor will be called.
     GetSurfaceManager()->UnregisterSurfaceFactoryClient(
         id_allocator_->id_namespace());
 
     parent_surface_id_namespace_ = 0;
+
+    // After the RenderWidgetHostViewChildFrame loses the frame_connector, it
+    // won't be able to walk up the frame tree anymore. Cleanup anything that
+    // needs to be done through the CrossProcessFrameConnector.

[Charlie Reis, 2016/07/07 21:47:13]

nit: s/Cleanup/Clean up/
nit: Add "before it's gone."
nit: Blank line between lines 83 and 84.

[lfg, 2016/07/11 19:11:29]

Done.

+    // Unlocks the mouse if this RenderWidgetHostView holds the lock.
+    UnlockMouse();
   }
   frame_connector_ = frame_connector;
   if (frame_connector_) {
     GetSurfaceManager()->RegisterSurfaceFactoryClient(
         id_allocator_->id_namespace(), this);
     RenderWidgetHostViewBase* parent_view =
         frame_connector_->GetParentRenderWidgetHostView();
     if (parent_view) {
       parent_surface_id_namespace_ = parent_view->GetSurfaceIdNamespace();
       DCHECK_NE(parent_surface_id_namespace_, 0u);
@@ skipping 372 matching lines @@
   frame_connector_->ForwardProcessAckedTouchEvent(touch, ack_result);
 }
 
 bool RenderWidgetHostViewChildFrame::LockMouse() {
   if (frame_connector_)
     return frame_connector_->LockMouse();
   return false;
 }
 
 void RenderWidgetHostViewChildFrame::UnlockMouse() {
+  if (host_->delegate() && host_->delegate()->HasMouseLock(host_) &&
+      frame_connector_)
+    frame_connector_->UnlockMouse();
 }
 
 bool RenderWidgetHostViewChildFrame::IsMouseLocked() {
-  if (!frame_connector_)
+  if (!host_->delegate())
     return false;
 
-  RenderWidgetHostViewBase* root_view =
-      frame_connector_->GetRootRenderWidgetHostView();
-
-  if (root_view)
-    return root_view->IsMouseLocked();
-
-  return false;
+  return host_->delegate()->HasMouseLock(host_);
 }
 
 uint32_t RenderWidgetHostViewChildFrame::GetSurfaceIdNamespace() {
   return id_allocator_->id_namespace();
 }
 
 void RenderWidgetHostViewChildFrame::ProcessKeyboardEvent(
     const NativeWebKeyboardEvent& event) {
   host_->ForwardKeyboardEvent(event);
 }
@@ skipping 193 matching lines @@
 
 bool RenderWidgetHostViewChildFrame::IsChildFrameForTesting() const {
   return true;
 }
 
 cc::SurfaceId RenderWidgetHostViewChildFrame::SurfaceIdForTesting() const {
   return surface_id_;
 };
 
 }  // namespace content