Fix crash on clicking on <select> tag

chrome/browser/apps/guest_view/web_view_browsertest.cc

Index: chrome/browser/apps/guest_view/web_view_browsertest.cc
diff --git a/chrome/browser/apps/guest_view/web_view_browsertest.cc b/chrome/browser/apps/guest_view/web_view_browsertest.cc
index a414b173709fe761877f3ab2d079c46e5197d056..cb39291b9871f8320d8d0360ae51ce06c861b159 100644
--- a/chrome/browser/apps/guest_view/web_view_browsertest.cc
+++ b/chrome/browser/apps/guest_view/web_view_browsertest.cc
@@ -87,6 +87,12 @@
 #include "ui/views/view.h"
 #include "ui/views/widget/widget.h"
 
+#if defined (USE_AURA)
+#include "content/common/view_messages.h"
+#include "content/public/browser/browser_message_filter.h"
+#include "ipc/ipc_message_macros.h"
+#endif
+
 #if defined(ENABLE_PLUGINS)
 #include "content/public/browser/plugin_service.h"
 #include "content/public/common/webplugininfo.h"
@@ -246,6 +252,51 @@ views::View* FindWebView(views::View* view) {
   }
   return nullptr;
 }
+
+// Waits for widget shown/closed.
+class WidgetUpdatedWaiter : public content::BrowserMessageFilter {
+ public:
+  explicit WidgetUpdatedWaiter(content::WebContents* web_contents)
+      : content::BrowserMessageFilter(ViewMsgStart) {
+    web_contents->GetRenderProcessHost()->AddFilter(this);
+  }
+
+  bool OnMessageReceived(const IPC::Message& message) override {
+    IPC_BEGIN_MESSAGE_MAP(WidgetUpdatedWaiter, message)
+      IPC_MESSAGE_HANDLER(ViewHostMsg_ShowWidget, OnShowWidget)
+      IPC_MESSAGE_HANDLER(ViewHostMsg_Close, OnCloseWidget)
+    IPC_END_MESSAGE_MAP()
+    return false;
+  }
+
+  void Wait() {
+    message_loop_runner_ = new content::MessageLoopRunner;
+    message_loop_runner_->Run();
+    base::RunLoop().RunUntilIdle();
+  }
+
+ private:
+  ~WidgetUpdatedWaiter() override {}
+
+  void OnShowWidget(int route_id, const gfx::Rect& initial_rect) {
+    content::BrowserThread::PostTask(
+        content::BrowserThread::UI, FROM_HERE,
+        base::Bind(&WidgetUpdatedWaiter::OnWidgetUpdatedOnUI, this));
+  }
+  void OnCloseWidget() {
+    content::BrowserThread::PostTask(
+        content::BrowserThread::UI, FROM_HERE,
+        base::Bind(&WidgetUpdatedWaiter::OnWidgetUpdatedOnUI, this));
+  }
+
+  void OnWidgetUpdatedOnUI() {
+    message_loop_runner_->Quit();
+  }
+
+  scoped_refptr<content::MessageLoopRunner> message_loop_runner_;
+
+  DISALLOW_COPY_AND_ASSIGN(WidgetUpdatedWaiter);
+};
 #endif
 
 }  // namespace
@@ -1127,6 +1178,37 @@ IN_PROC_BROWSER_TEST_P(WebViewTest, Shim_TestWebRequestAPIErrorOccurred) {
   TestHelper("testWebRequestAPIErrorOccurred", "web_view/shim", NO_TEST_SERVER);
 }
 
+#if defined(USE_AURA)
+// Test validates that select tag can be shown and hidden in webview safely
+// using quick touch.
+IN_PROC_BROWSER_TEST_P(WebViewTest, SelectShowHide) {
+  LoadAppWithGuest("web_view/select");
+
+  content::WebContents* embedder_contents = GetFirstAppWindowWebContents();
+  ASSERT_TRUE(embedder_contents);
+
+  std::vector<content::WebContents*> guest_contents_list;
+  GetGuestViewManager()->GetGuestWebContentsList(&guest_contents_list);
+  ASSERT_EQ(1u, guest_contents_list.size());
+  content::WebContents* guest_contents = guest_contents_list[0];
+
+  const gfx::Rect embedder_rect = embedder_contents->GetContainerBounds();
+  const gfx::Rect guest_rect = guest_contents->GetContainerBounds();
+  const gfx::Point click_point(guest_rect.x() - embedder_rect.x() + 10,
+                               guest_rect.y() - embedder_rect.y() + 10);
+
+  scoped_refptr<WidgetUpdatedWaiter> widget_updated_waiter =
+      new WidgetUpdatedWaiter(guest_contents);
+
+  for (int i = 0; i < 10; ++i) {
+    // Important, pass mouse click to embedder in order to transfer focus.
+    content::SimulateMouseClickAt(
+        embedder_contents, 0, blink::WebMouseEvent::ButtonLeft, click_point);
+    widget_updated_waiter->Wait();
+  }
+}
+#endif
+
 // http://crbug.com/315920
 #if defined(GOOGLE_CHROME_BUILD) && (defined(OS_WIN) || defined(OS_LINUX))
 #define MAYBE_Shim_TestChromeExtensionURL DISABLED_Shim_TestChromeExtensionURL