Request to start/stop calculating composition info from RenderWidget when it is active/inactive.

content/browser/renderer_host/render_widget_host_view_aura.h

Index: content/browser/renderer_host/render_widget_host_view_aura.h
diff --git a/content/browser/renderer_host/render_widget_host_view_aura.h b/content/browser/renderer_host/render_widget_host_view_aura.h
index 813265c77f3a3aa480b61f0a6020a15278fea042..a0b23a81df0433a7936317e180e6a6f0dcbd55ff 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.h
+++ b/content/browser/renderer_host/render_widget_host_view_aura.h
@@ -687,6 +687,9 @@ class CONTENT_EXPORT RenderWidgetHostViewAura
   // RenderWidgetHostInputEventRouter.
   bool disable_input_event_router_for_testing_;
 
+  // The last RenderWidgetHost which had an active text input state.
+  RenderWidgetHostImpl* last_active_widget_;

[Charlie Reis, 2016/08/03 22:16:23]

What guarantees we won't get a use-after-free here?  (Maybe it would be safer to
store the routing ID and look it up later?)

[EhsanK, 2016/08/04 18:57:58]

Actually, there was a way to crash this. Good catch! Thanks! I changed the code
to use routing/process id instead.

The crash happens because we detach from TextInputManager in the dtor of
RenderWidgetHostViewBase. A child frame deletes itself in a post task. So we
could lose the widget and then get to RWHVAura::OnUpdateTextInputStateCalled()
when we hit ~RWHVBase() which is a UaF. Crash happens if we suddenly remove RWH
when we have an <input> which is focused (i.e., detach a frame with javascript
code while the <input> inside the frame is still focused).

But before all this, if we could safely call RWHVBase::GetRenderWidgetHost(), I
could simply use |updated_view| in RWHVAura::OnUpdateTextInputStateCalled().
Unfortunately, when destroying active view we would get a crash due to pure
virtual call.

+
   base::WeakPtrFactory<RenderWidgetHostViewAura> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostViewAura);