Fix the crash when swap the WebContents with power save blocker.

content/browser/android/content_view_core_impl.cc

Index: content/browser/android/content_view_core_impl.cc
diff --git a/content/browser/android/content_view_core_impl.cc b/content/browser/android/content_view_core_impl.cc
index 340aba161ab810f999891cf06db99d25c8fc66af..dbd499e654358ba00ba439c703249f24db834a14 100644
--- a/content/browser/android/content_view_core_impl.cc
+++ b/content/browser/android/content_view_core_impl.cc
@@ -272,6 +272,15 @@ void ContentViewCoreImpl::OnJavaContentViewCoreDestroyed(JNIEnv* env,
                                                          jobject obj) {
   DCHECK(env->IsSameObject(java_ref_.get(env).obj(), obj));
   java_ref_.reset();
+  // Java peer has gone, ContentViewCore is not functional and waits to
+  // be destroyed with WebContents.
+  // We need to reset WebContentsViewAndroid's reference, otherwise, there
+  // could have call in when swapping the WebContents,
+  // see http://crbug.com/383939 .
+  DCHECK(web_contents_);
+  static_cast<WebContentsViewAndroid*>(

[Yaron, 2014/06/30 23:45:03]

Ok, the only other consideration is that the WebContent's view is |this|. Are we
sure that's the case? Can this fire asynchronously as part of any swap, whereby
this happens after we've already updated the pointer elsewhere?

Put another way: InitWebContents below sets CVC for the newly created one. Are
you certain we wouldn't be unsetting it?

[michaelbai, 2014/07/01 01:10:40]

How this could happen? from current code path, we can not swap the
ContentViewCore.

Also, the DCHECK in line 273 implies this.

On 2014/06/30 23:45:03, Yaron wrote:

+      static_cast<WebContentsImpl*>(web_contents_)->GetView())->
+          SetContentViewCore(NULL);
 }
 
 void ContentViewCoreImpl::InitWebContents() {