WebUI: prevent WebContent to hold invalid pointer.

chrome/browser/ui/webui/constrained_web_dialog_delegate_base.cc

Index: chrome/browser/ui/webui/constrained_web_dialog_delegate_base.cc
diff --git a/chrome/browser/ui/webui/constrained_web_dialog_delegate_base.cc b/chrome/browser/ui/webui/constrained_web_dialog_delegate_base.cc
index fc5275f224f37bb50e7f8be00abf2afa5c3ac54d..cd7d85e6ff5c00c1a003b6441652377bedd0f1de 100644
--- a/chrome/browser/ui/webui/constrained_web_dialog_delegate_base.cc
+++ b/chrome/browser/ui/webui/constrained_web_dialog_delegate_base.cc
@@ -34,6 +34,7 @@ ConstrainedWebDialogDelegateBase::ConstrainedWebDialogDelegateBase(
   CHECK(delegate);
   web_contents_.reset(
       WebContents::Create(WebContents::CreateParams(browser_context)));
+  WebContentsObserver::Observe(web_contents_.get());
   zoom::ZoomController::CreateForWebContents(web_contents_.get());
   if (tab_delegate) {
     override_tab_delegate_.reset(tab_delegate);
@@ -58,8 +59,12 @@ ConstrainedWebDialogDelegateBase::ConstrainedWebDialogDelegateBase(
 }
 
 ConstrainedWebDialogDelegateBase::~ConstrainedWebDialogDelegateBase() {
-  if (release_contents_on_close_)
+  if (release_contents_on_close_ && web_contents_) {
+    // Remove reference to |this| in the WebContent since the lifetime of the
+    // WebContent may exceed the one of this object.
+    ConstrainedWebDialogUI::ClearConstrainedDelegate(web_contents_.get());
     ignore_result(web_contents_.release());
+  }
 }
 
 const WebDialogDelegate*
@@ -114,6 +119,10 @@ gfx::Size ConstrainedWebDialogDelegateBase::GetPreferredSize() const {
   return gfx::Size();
 }
 
+void ConstrainedWebDialogDelegateBase::WebContentsDestroyed() {
+  web_contents_.release();

[Lei Zhang, 2017/04/07 00:55:22]

This release() makes the ownership of |web_contents_| questionable. I'll try to
write a CL to make it cleaner.

The failing test in patch set 1 tries to simulate what's happening in the
browser, and the WebContents should outlive the ConstrainedWebDialog. However,
some implementation detail in ConstrainedWebDialogDelegateViewViews means even
though the test called OnDialogCloseFromWebUI(), the dialog does not actually
get destroyed until later.

+}
+
 void ConstrainedWebDialogDelegateBase::ResizeToGivenSize(
     const gfx::Size size) {
   NOTREACHED();