Fix crash when destroying a RenderWidgetHost that holds the pointer

content/browser/frame_host/render_widget_host_view_child_frame.cc

Index: content/browser/frame_host/render_widget_host_view_child_frame.cc
diff --git a/content/browser/frame_host/render_widget_host_view_child_frame.cc b/content/browser/frame_host/render_widget_host_view_child_frame.cc
index 88ea407cb7071d6c6b3539d591e0caf8d6f47146..b1606b26b9e9767410a0f2e84814b0e071b93ead 100644
--- a/content/browser/frame_host/render_widget_host_view_child_frame.cc
+++ b/content/browser/frame_host/render_widget_host_view_child_frame.cc
@@ -77,6 +77,9 @@ void RenderWidgetHostViewChildFrame::SetCrossProcessFrameConnector(
         id_allocator_->id_namespace());
 
     parent_surface_id_namespace_ = 0;
+
+    // Unlocks the mouse if this RenderWidgetHostView holds the lock.
+    UnlockMouse();

[Charlie Reis, 2016/07/06 17:41:47]

This seems a bit random to me.  I wouldn't expect this method to have a bunch of
feature-specific reset code here, or if it did, there would likely be more than
just mouse lock.  Is there a more general place that should trigger this?  If
not, can you add a comment about what sorts of things need resetting when the
frame connector changes?

[lfg, 2016/07/07 20:17:35]

For both Aura and Mac, this cleanup happens in the destructor. The problem in
RWHVChildFrame, is that after it loses the CrossProcessFrameConnector there's no
way to walk the frame tree anymore, so I thought this was the next best place to
have the cleanup. I think the option to unlock it in the destructor would be
possible by using a virtual in RWHDelegate, and do the unlock through
WebContents, but that seems like a much worse option than doing it here (since
we would have to add a bunch of code to RenderWidgetHost that's specific to the
child frame case).

I'll add a comment about cleaning up things that need to walk the frame tree.

[Charlie Reis, 2016/07/07 21:47:12]

Acknowledged.

   }
   frame_connector_ = frame_connector;
   if (frame_connector_) {
@@ -475,19 +478,16 @@ bool RenderWidgetHostViewChildFrame::LockMouse() {
 }
 
 void RenderWidgetHostViewChildFrame::UnlockMouse() {
+  if (host_->delegate() && host_->delegate()->HasMouseLock(host_) &&
+      frame_connector_)
+    frame_connector_->UnlockMouse();
 }
 
 bool RenderWidgetHostViewChildFrame::IsMouseLocked() {
-  if (!frame_connector_)
+  if (!host_->delegate())
     return false;
 
-  RenderWidgetHostViewBase* root_view =
-      frame_connector_->GetRootRenderWidgetHostView();
-
-  if (root_view)
-    return root_view->IsMouseLocked();
-
-  return false;
+  return host_->delegate()->HasMouseLock(host_);
 }
 
 uint32_t RenderWidgetHostViewChildFrame::GetSurfaceIdNamespace() {