Fix a crash occuring during the destruction of TextInputManager on Android.

content/browser/renderer_host/text_input_manager.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_RENDERER_HOST_TEXT_INPUT_MANAGER_H__
 #define CONTENT_BROWSER_RENDERER_HOST_TEXT_INPUT_MANAGER_H__
 
 #include <unordered_map>
 #include <utility>
 
@@ skipping 19 matching lines @@
 class CONTENT_EXPORT TextInputManager {
  public:
   // The tab's top-level RWHV should be an observer of TextInputManager to get
   // notifications about changes in TextInputState or other IME related state
   // for child frames.
   class CONTENT_EXPORT Observer {
    public:
     // Called when a view has called UpdateTextInputState on TextInputManager.
     // If the call has led to a change in TextInputState, |did_update_state| is
     // true. In some plaforms, we need this update even when the state has not
-    // changed (e.g., Aura for updating IME).
+    // changed (e.g., Aura for updating IME). Also note that |updated_view| is
+    // the view which has most recently received an update in TextInputState.
+    // |updated_view| should not be used to obtain any IME state since this
+    // observer method might have been called in the process of unregistering
+    // |active_view_| from TextInputManager (which in turn is a result of either
+    // destroying |active_view_| or TextInputManager).
     virtual void OnUpdateTextInputStateCalled(
         TextInputManager* text_input_manager,
         RenderWidgetHostViewBase* updated_view,
         bool did_update_state) {}
     // Called when |updated_view| has called ImeCancelComposition on
     // TextInputManager.
     virtual void OnImeCancelComposition(
         TextInputManager* text_input_manager,
         RenderWidgetHostViewBase* updated_view) {}
     // Called when |updated_view| has changed its SelectionRegion.
@@ skipping 65 matching lines @@
   // |active_view_|.
   RenderWidgetHostImpl* GetActiveWidget() const;
 
   // ---------------------------------------------------------------------------
   // The following methods can be used to obtain information about IME-related
   // state for the active RenderWidgetHost. If the active widget is nullptr, the
   // methods below will return nullptr as well.
   // Users of these methods should not hold on to the pointers as they become
   // dangling if the TextInputManager or |active_view_| are destroyed.
 
-  // Returns the currently stored TextInputState for |view|. A state of nullptr
-  // can be interpreted as a ui::TextInputType of ui::TEXT_INPUT_TYPE_NONE for
-  // the view. If |view| is null and there is an |active_view_|, the state for
-  // |active_view_| is returned.
-  const TextInputState* GetTextInputState(
-      RenderWidgetHostViewBase* view = nullptr) const;
+  // Returns the currently stored TextInputState for |active_view_|. A state of
+  // nullptr can be interpreted as a ui::TextInputType of
+  // ui::TEXT_INPUT_TYPE_NONE.
+  const TextInputState* GetTextInputState() const;
 
   // Returns the selection bounds information for |view|. If |view| == nullptr,
   // it will return the corresponding information for |active_view_| or nullptr
   // if there are no active views.
   const SelectionRegion* GetSelectionRegion(
       RenderWidgetHostViewBase* view = nullptr) const;
 
   // Returns the composition range and character bounds information for the
   // |view|. If |view| == nullptr, it will assume |active_view_| and return its
   // state. If |active_view_| == nullptr, this method will return nullptr.
@@ skipping 88 matching lines @@
   ViewMap<CompositionRangeInfo> composition_range_info_map_;
   ViewMap<TextSelection> text_selection_map_;
 
   base::ObserverList<Observer> observer_list_;
 
   DISALLOW_COPY_AND_ASSIGN(TextInputManager);
 };
 }
 
 #endif  // CONTENT_BROWSER_RENDERER_HOST_TEXT_INPUT_MANAGER_H__