Do not trigger action mode actions after being destroyed.

After calling destroy on the action mode, you can still click on the
view as it is being torn down.  This can cause you to call methods
on a defunct CVC in certain cases causing a crash.

To work around this, track if destroy has been called and stop calling
our handler in that case.

BUG=525365

Review URL: https://codereview.chromium.org/1323263004

Cr-Commit-Position: refs/heads/master@{#347298}

1 files changed, 5 insertions, 0 deletions

diff --git a/content/public/android/java/src/org/chromium/content/browser/WebActionModeCallback.java b/content/public/android/java/src/org/chromium/content/browser/WebActionModeCallback.java
index 9e62d7e..082068a 100644
--- a/content/public/android/java/src/org/chromium/content/browser/WebActionModeCallback.java
+++ b/content/public/android/java/src/org/chromium/content/browser/WebActionModeCallback.java
@@ -105,6 +105,7 @@ public class WebActionModeCallback implements ActionMode.Callback {
     private boolean mEditable;
     private boolean mIsPasswordType;
     private boolean mIsInsertion;
+    private boolean mIsDestroyed;
 
     public WebActionModeCallback(Context context, ActionHandler actionHandler) {
         mContext = context;
@@ -189,6 +190,8 @@ public class WebActionModeCallback implements ActionMode.Callback {
 
     @Override
     public boolean onActionItemClicked(ActionMode mode, MenuItem item) {
+        if (mIsDestroyed) return true;
+
         int id = item.getItemId();
 
         if (id == R.id.select_action_menu_select_all) {
@@ -216,6 +219,7 @@ public class WebActionModeCallback implements ActionMode.Callback {
 
     @Override
     public void onDestroyActionMode(ActionMode mode) {
+        mIsDestroyed = true;
         mActionHandler.onDestroyActionMode();
     }
 
@@ -229,6 +233,7 @@ public class WebActionModeCallback implements ActionMode.Callback {
      * @param outRect The Rect to be populated with the content position.
      */
     public void onGetContentRect(ActionMode mode, View view, Rect outRect) {
+        if (mIsDestroyed) return;
         mActionHandler.onGetContentRect(outRect);
     }