[Android WebView] Fix use after free during compositor shutdown.

If the WebContents is destroyed then the SynchronousCompositor will
be deleted before the InputHandler is deleted.

Additionally we also NULL out the back pointer to the synchronous
compositor from the input handler when the synchronous compositor
is destroyed.

BUG=

Review URL: https://chromiumcodereview.appspot.com/16560007

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@205900 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 10 insertions, 0 deletions

diff --git a/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsTest.java b/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsTest.java
index 2045d55..717945f 100644
--- a/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsTest.java
+++ b/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsTest.java
@@ -348,4 +348,14 @@ public class AwContentsTest extends AwTestBase {
             if (webServer != null) webServer.shutdown();
         }
     }
+
+    @SmallTest
+    @Feature({"AndroidWebView"})
+    public void testCreateLoadPageDestroy() throws Throwable {
+        AwTestContainerView awTestContainerView =
+                createAwTestContainerViewOnMainSync(mContentsClient);
+        loadUrlSync(awTestContainerView.getAwContents(),
+                mContentsClient.getOnPageFinishedHelper(), CommonResources.ABOUT_HTML);
+        awTestContainerView.destroy();
+    }
 }