Request to start/stop calculating composition info from RenderWidget when it is active/inactive.

content/browser/renderer_host/render_widget_host_view_aura.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_RENDERER_HOST_RENDER_WIDGET_HOST_VIEW_AURA_H_
 #define CONTENT_BROWSER_RENDERER_HOST_RENDER_WIDGET_HOST_VIEW_AURA_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 669 matching lines @@
   // the current view has focus. Defaults to false.
   bool set_focus_on_mouse_down_or_key_event_;
 
   float device_scale_factor_;
 
   // Allows tests to send gesture events for testing without first sending a
   // corresponding touch sequence, as would be required by
   // RenderWidgetHostInputEventRouter.
   bool disable_input_event_router_for_testing_;
 
+  // The last RenderWidgetHost which had an active text input state.
+  RenderWidgetHostImpl* last_active_widget_;

[Charlie Reis, 2016/08/03 22:16:23]

What guarantees we won't get a use-after-free here?  (Maybe it would be safer to
store the routing ID and look it up later?)

[EhsanK, 2016/08/04 18:57:58]

Actually, there was a way to crash this. Good catch! Thanks! I changed the code
to use routing/process id instead.

The crash happens because we detach from TextInputManager in the dtor of
RenderWidgetHostViewBase. A child frame deletes itself in a post task. So we
could lose the widget and then get to RWHVAura::OnUpdateTextInputStateCalled()
when we hit ~RWHVBase() which is a UaF. Crash happens if we suddenly remove RWH
when we have an <input> which is focused (i.e., detach a frame with javascript
code while the <input> inside the frame is still focused).

But before all this, if we could safely call RWHVBase::GetRenderWidgetHost(), I
could simply use |updated_view| in RWHVAura::OnUpdateTextInputStateCalled().
Unfortunately, when destroying active view we would get a crash due to pure
virtual call.

+
   base::WeakPtrFactory<RenderWidgetHostViewAura> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostViewAura);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_RENDERER_HOST_RENDER_WIDGET_HOST_VIEW_AURA_H_