Fix crash when destroying a RenderWidgetHost that holds the pointer

chrome/browser/site_per_process_interactive_browsertest.cc

Index: chrome/browser/site_per_process_interactive_browsertest.cc
diff --git a/chrome/browser/site_per_process_interactive_browsertest.cc b/chrome/browser/site_per_process_interactive_browsertest.cc
index c063ef805fb898a86ef14784d33f07679e2c7d4d..12dc703b6c35edb9cf30e28cf87945e4dcd3ce4d 100644
--- a/chrome/browser/site_per_process_interactive_browsertest.cc
+++ b/chrome/browser/site_per_process_interactive_browsertest.cc
@@ -741,3 +741,28 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessInteractiveBrowserTest,
   EXPECT_FALSE(ElementHasFullscreenStyle(c_middle, "child-0"));
 }
 
+IN_PROC_BROWSER_TEST_F(SitePerProcessInteractiveBrowserTest,
+                       RenderWidgetHostDeletedWhileMouseLocked) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  ui_test_utils::NavigateToURL(browser(), main_url);
+
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  content::RenderFrameHost* main_frame = web_contents->GetMainFrame();
+  content::RenderFrameHost* child = ChildFrameAt(main_frame, 0);
+
+  EXPECT_TRUE(ExecuteScript(child, "document.body.requestPointerLock()"));
+  bool mouse_locked = false;
+  EXPECT_TRUE(ExecuteScriptAndExtractBool(child,
+                                          "window.domAutomationController.send("
+                                          "document.body == "
+                                          "document.pointerLockElement)",
+                                          &mouse_locked));
+  EXPECT_TRUE(mouse_locked);
+
+  EXPECT_TRUE(ExecuteScript(main_frame,
+                            "document.querySelector('iframe').parentNode."
+                            "removeChild(document.querySelector('iframe'))"));

[Charlie Reis, 2016/07/07 21:47:13]

Maybe it's worth adding a comment that this used to crash due to
https://crbug.com/619571.

Also, is it useful to check mouse_locked again after this?

[lfg, 2016/07/11 19:11:29]

Done.
Done.

+}