Fix the crash when swap the WebContents with power save blocker.

content/browser/android/content_view_core_impl.cc

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/android/content_view_core_impl.h"
 
 #include "base/android/jni_android.h"
 #include "base/android/jni_array.h"
 #include "base/android/jni_string.h"
 #include "base/android/scoped_java_ref.h"
@@ skipping 254 matching lines @@
 
 base::android::ScopedJavaLocalRef<jobject>
 ContentViewCoreImpl::GetWebContentsAndroid(JNIEnv* env, jobject obj) {
   return web_contents_->GetJavaWebContents();
 }
 
 void ContentViewCoreImpl::OnJavaContentViewCoreDestroyed(JNIEnv* env,
                                                          jobject obj) {
   DCHECK(env->IsSameObject(java_ref_.get(env).obj(), obj));
   java_ref_.reset();
+  // Java peer has gone, ContentViewCore is not functional and waits to
+  // be destroyed with WebContents.
+  // We need to reset WebContentsViewAndroid's reference, otherwise, there
+  // could have call in when swapping the WebContents,
+  // see http://crbug.com/383939 .
+  DCHECK(web_contents_);
+  static_cast<WebContentsViewAndroid*>(

[Yaron, 2014/06/30 23:45:03]

Ok, the only other consideration is that the WebContent's view is |this|. Are we
sure that's the case? Can this fire asynchronously as part of any swap, whereby
this happens after we've already updated the pointer elsewhere?

Put another way: InitWebContents below sets CVC for the newly created one. Are
you certain we wouldn't be unsetting it?

[michaelbai, 2014/07/01 01:10:40]

How this could happen? from current code path, we can not swap the
ContentViewCore.

Also, the DCHECK in line 273 implies this.

On 2014/06/30 23:45:03, Yaron wrote:

+      static_cast<WebContentsImpl*>(web_contents_)->GetView())->
+          SetContentViewCore(NULL);
 }
 
 void ContentViewCoreImpl::InitWebContents() {
   DCHECK(web_contents_);
   static_cast<WebContentsViewAndroid*>(
       static_cast<WebContentsImpl*>(web_contents_)->GetView())->
           SetContentViewCore(this);
   DCHECK(!web_contents_->GetUserData(kContentViewUserDataKey));
   web_contents_->SetUserData(kContentViewUserDataKey,
                              new ContentViewUserData(this));
@@ skipping 1405 matching lines @@
       reinterpret_cast<ui::WindowAndroid*>(window_android),
       retained_objects_set);
   return reinterpret_cast<intptr_t>(view);
 }
 
 bool RegisterContentViewCore(JNIEnv* env) {
   return RegisterNativesImpl(env);
 }
 
 }  // namespace content