In TextInputManager, reset input type to none before switching active widgets.

content/browser/renderer_host/render_widget_host_view_aura.cc

Index: content/browser/renderer_host/render_widget_host_view_aura.cc
diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
index 34b8ff6150519975b06cc16b19e7dc48b4945912..60e6b8c8e7cbebdcee4e85ffb7591d5ae982abba 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
@@ -2978,6 +2978,12 @@ void RenderWidgetHostViewAura::OnUpdateTextInputStateCalled(
     bool did_update_state) {
   DCHECK_EQ(text_input_manager_, text_input_manager);
 
+  // We only process updates from the active widget as the ones from other views
+  // are due to late arriving IPCs which are no longer needed.
+  if (GetTextInputManager()->GetActiveWidget() !=
+      updated_view->GetRenderWidgetHost())

[EhsanK, 2016/07/27 16:17:44]

The intention for adding this logic was to make sure we do not process the late
arriving IPC to reset state since we have already synthesized it. But
unfortunately, GetRenderWidgetHost() is pure virtual, and we may get here during
the destruction path for the active view as well. This was causing crashes.

Now the early return stays in TextInputManager::UpdateTextInputState. The only
thing we betray is that we never make an observer call when the stale IPC
arrives (against the fact that we have named the observer method
OnUpdateTextInputStateCalled). But I believe it is correct, and fine, since the
stale IPC has already been synthesized/emulated/simulated (not sure which word
fits here).

+    return;
+
   if (!GetInputMethod())
     return;