Fix crash on clicking on <select> tag

content/browser/renderer_host/render_widget_host_view_aura.cc

Index: content/browser/renderer_host/render_widget_host_view_aura.cc
diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
index 7940896835bfe89771a903f186ec65da81513879..abbbef0640f77b614d3e37360e180d223f86998d 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
@@ -2460,6 +2460,8 @@ void RenderWidgetHostViewAura::UpdateCursorIfOverSelf() {
 }
 
 ui::InputMethod* RenderWidgetHostViewAura::GetInputMethod() const {
+  if (!window_)

[khmel, 2016/07/11 19:33:12]

Here is a race condition.

When I click on <select> tag as described in bug, RenderWidget is created and
shown. However it is done in 2 steps. First step is to create widget (IPC
redirects to RenderWidgetHostViewAura CTOR). Second step is to show widget (IPC
redirects to RenderWidgetHostViewAura::CreateAuraWindow).
In RenderWidgetHostViewAura CTOR observer for TextInputManager is registered. 

Crash happens when periodic RenderWidget::UpdateTextInputState is called between
step 1 and 2. In this case TextInputManager notifies RenderWidgetHostViewAura
which assumes that window_ is created.

[Shu Chen, 2016/07/13 05:56:16]

Thanks for fixing this!

The InputMethod is necessary to let the web contents receive the correct
keydown/keypress/keyup. So if NULL is returned here, the web contents would not
receive any key events. Thus, the typing-to-select-item feature might be broken.

Can you please confirm there are more RenderWidget::UpdateTextInputState() calls
following the step 2?

I think the ideal fix is to make sure the UpdateTextInputState() is always
called after step 2. But I'm OK with the solution here if
RenderWidget::UpdateTextInputState() is periodic and after step 2.

Btw, it will be nice if you can add a test for this change.

+    return NULL;
   aura::Window* root_window = window_->GetRootWindow();
   if (!root_window)
     return NULL;