Fix a crash occuring during the destruction of TextInputManager on Android.

chrome/browser/renderer_host/site_per_process_text_input_browsertest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/chrome_content_browser_client.h"
 #include "chrome/browser/ui/browser.h"
@@ skipping 620 matching lines @@
   SimulateKeyPress(active_contents(), ui::DomKey::TAB, ui::DomCode::TAB,
                    ui::VKEY_TAB, false, false, false, false);
   set_state_observer.Wait();
 
   TextInputManagerTypeObserver reset_state_observer(active_contents(),
                                                     ui::TEXT_INPUT_TYPE_NONE);
   ui_test_utils::NavigateToURL(browser(), GURL("about:blank"));
   reset_state_observer.Wait();
 }
 
+// This test verifies that if we have a focused <input> in the main frame and
+// the tab is closed, TextInputManager handles unregistering itself and
+// notifying the observers properly (see https://crbug.com/669375).
+IN_PROC_BROWSER_TEST_F(SitePerProcessTextInputManagerTest,
+                       ClosingTabWillNotCrash) {
+  CreateIframePage("a()");
+  content::RenderFrameHost* main_frame = GetFrame(IndexVector{});
+  AddInputFieldToFrame(main_frame, "text", "", false);
+
+  // Focus the input and wait for state update.
+  TextInputManagerTypeObserver observer(active_contents(),
+                                        ui::TEXT_INPUT_TYPE_TEXT);
+  SimulateKeyPress(active_contents(), ui::DomKey::TAB, ui::DomCode::TAB,
+                   ui::VKEY_TAB, false, false, false, false);
+  observer.Wait();
+
+  // Now destroy the tab. We should exit without crashing.
+  browser()->tab_strip_model()->CloseWebContentsAt(
+      0, TabStripModel::CLOSE_USER_GESTURE);
+}
+
 // The following test verifies that when the active widget changes value, it is
 // always from nullptr to non-null or vice versa.
 IN_PROC_BROWSER_TEST_F(SitePerProcessTextInputManagerTest,
                        ResetTextInputStateOnActiveWidgetChange) {
   CreateIframePage("a(b,c(a,b),d)");
   std::vector<content::RenderFrameHost*> frames{
       GetFrame(IndexVector{}),     GetFrame(IndexVector{0}),
       GetFrame(IndexVector{1}),    GetFrame(IndexVector{1, 0}),
       GetFrame(IndexVector{1, 1}), GetFrame(IndexVector{2})};
   std::vector<content::RenderWidgetHostView*> views;
@@ skipping 189 matching lines @@
     content::RenderFrameHost* frame = frames[i / 2];
     FocusFormField(frame, values[i]);
     FormFieldDataVerifier verifier(values[i], placeholders[i]);
     content::FormFieldDataCallback callback =
         base::Bind(&FormFieldDataVerifier::Verify, base::Unretained(&verifier));
     frame->RequestFocusedFormFieldData(callback);
     verifier.Wait();
   }
 }
 
-
 // TODO(ekaramad): The following tests are specifically written for Aura and are
 // based on InputMethodObserver. Write similar tests for Mac/Android/Mus
 // (crbug.com/602723).
 #if defined(USE_AURA)
 // -----------------------------------------------------------------------------
 // Input Method Observer Tests
 //
 // The following tests will make use of the InputMethodObserver to verify that
 // OOPIF pages interact properly with the InputMethod through the tab's view.
 
@@ skipping 361 matching lines @@
 
   // Closing this WebContents while we still hold on to our TestBrowserClient.
   EXPECT_TRUE(browser()->tab_strip_model()->CloseWebContentsAt(
       1, TabStripModel::CLOSE_USER_GESTURE));
 
   // For the cleanup of the original WebContents in tab index 0.
   content::SetBrowserClientForTesting(old_browser_client);
 }
 #endif  //  defined(MAC_OSX)
 #endif  // !defined(OS_ANDROID)