Fix crash on clicking on <select> tag

content/browser/renderer_host/render_widget_host_view_aura.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_view_aura.h"
 
 #include <set>
 #include <utility>
 
 #include "base/auto_reset.h"
@@ skipping 2442 matching lines @@
     cursor = ui::kCursorPointer;
 
   aura::client::CursorClient* cursor_client =
       aura::client::GetCursorClient(root_window);
   if (cursor_client) {
     cursor_client->SetCursor(cursor);
   }
 }
 
 ui::InputMethod* RenderWidgetHostViewAura::GetInputMethod() const {
+  if (!window_)

[khmel, 2016/07/11 19:33:12]

Here is a race condition.

When I click on <select> tag as described in bug, RenderWidget is created and
shown. However it is done in 2 steps. First step is to create widget (IPC
redirects to RenderWidgetHostViewAura CTOR). Second step is to show widget (IPC
redirects to RenderWidgetHostViewAura::CreateAuraWindow).
In RenderWidgetHostViewAura CTOR observer for TextInputManager is registered. 

Crash happens when periodic RenderWidget::UpdateTextInputState is called between
step 1 and 2. In this case TextInputManager notifies RenderWidgetHostViewAura
which assumes that window_ is created.

[Shu Chen, 2016/07/13 05:56:16]

Thanks for fixing this!

The InputMethod is necessary to let the web contents receive the correct
keydown/keypress/keyup. So if NULL is returned here, the web contents would not
receive any key events. Thus, the typing-to-select-item feature might be broken.

Can you please confirm there are more RenderWidget::UpdateTextInputState() calls
following the step 2?

I think the ideal fix is to make sure the UpdateTextInputState() is always
called after step 2. But I'm OK with the solution here if
RenderWidget::UpdateTextInputState() is periodic and after step 2.

Btw, it will be nice if you can add a test for this change.

+    return NULL;
   aura::Window* root_window = window_->GetRootWindow();
   if (!root_window)
     return NULL;
   return root_window->GetHost()->GetInputMethod();
 }
 
 void RenderWidgetHostViewAura::Shutdown() {
   if (!in_shutdown_) {
     in_shutdown_ = true;
     host_->ShutdownAndDestroyWidget(true);
@@ skipping 528 matching lines @@
 
 ////////////////////////////////////////////////////////////////////////////////
 // RenderWidgetHostViewBase, public:
 
 // static
 void RenderWidgetHostViewBase::GetDefaultScreenInfo(WebScreenInfo* results) {
   GetScreenInfoForWindow(results, NULL);
 }
 
 }  // namespace content