In TextInputManager, reset input type to none before switching active widgets.

content/browser/renderer_host/render_widget_host_view_aura.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_view_aura.h"
 
 #include <set>
 #include <utility>
 
 #include "base/auto_reset.h"
@@ skipping 2960 matching lines @@
 cc::SurfaceId RenderWidgetHostViewAura::SurfaceIdForTesting() const {
   return delegated_frame_host_->SurfaceIdForTesting();
 }
 
 void RenderWidgetHostViewAura::OnUpdateTextInputStateCalled(
     TextInputManager* text_input_manager,
     RenderWidgetHostViewBase* updated_view,
     bool did_update_state) {
   DCHECK_EQ(text_input_manager_, text_input_manager);
 
+  // We only process updates from the active widget as the ones from other views
+  // are due to late arriving IPCs which are no longer needed.
+  if (GetTextInputManager()->GetActiveWidget() !=
+      updated_view->GetRenderWidgetHost())

[EhsanK, 2016/07/27 16:17:44]

The intention for adding this logic was to make sure we do not process the late
arriving IPC to reset state since we have already synthesized it. But
unfortunately, GetRenderWidgetHost() is pure virtual, and we may get here during
the destruction path for the active view as well. This was causing crashes.

Now the early return stays in TextInputManager::UpdateTextInputState. The only
thing we betray is that we never make an observer call when the stale IPC
arrives (against the fact that we have named the observer method
OnUpdateTextInputStateCalled). But I believe it is correct, and fine, since the
stale IPC has already been synthesized/emulated/simulated (not sure which word
fits here).

+    return;
+
   if (!GetInputMethod())
     return;
 
   if (did_update_state)
     GetInputMethod()->OnTextInputTypeChanged(this);
 
   const TextInputState* state = text_input_manager_->GetTextInputState();
 
   if (state && state->show_ime_if_needed &&
       state->type != ui::TEXT_INPUT_TYPE_NONE)
@@ skipping 49 matching lines @@
 
 ////////////////////////////////////////////////////////////////////////////////
 // RenderWidgetHostViewBase, public:
 
 // static
 void RenderWidgetHostViewBase::GetDefaultScreenInfo(WebScreenInfo* results) {
   GetScreenInfoForWindow(results, NULL);
 }
 
 }  // namespace content