Fix for crash in testWindows test

Avoid using Web Contents after it maybe deleted.

BUG=b/8341990

Review URL: https://chromiumcodereview.appspot.com/12668003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@187319 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 49 insertions, 9 deletions

diff --git a/android_webview/browser/browser_view_renderer_impl.cc b/android_webview/browser/browser_view_renderer_impl.cc
index ef1f9d1..27cca47 100644
--- a/android_webview/browser/browser_view_renderer_impl.cc
+++ b/android_webview/browser/browser_view_renderer_impl.cc
@@ -43,6 +43,8 @@ using base::android::ScopedJavaLocalRef;
 using content::Compositor;
 using content::ContentViewCore;
 
+namespace android_webview {
+
 namespace {
 
 // Provides software rendering functions from the Android glue layer.
@@ -100,9 +102,28 @@ static bool RasterizeIntoBitmap(JNIEnv* env,
   return succeeded;
 }
 
+const void* kUserDataKey = &kUserDataKey;
+
 }  // namespace
 
-namespace android_webview {
+class BrowserViewRendererImpl::UserData : public content::WebContents::Data {
+ public:
+  UserData(BrowserViewRendererImpl* ptr) : instance_(ptr) {}
+  virtual ~UserData() {
+    instance_->WebContentsGone();
+  }
+
+  static BrowserViewRendererImpl* GetInstance(content::WebContents* contents) {
+    if (!contents)
+      return NULL;
+    UserData* data = reinterpret_cast<UserData*>(
+        contents->GetUserData(kUserDataKey));
+    return data ? data->instance_ : NULL;
+  }
+
+ private:
+  BrowserViewRendererImpl* instance_;
+};
 
 // static
 BrowserViewRendererImpl* BrowserViewRendererImpl::Create(
@@ -111,6 +132,12 @@ BrowserViewRendererImpl* BrowserViewRendererImpl::Create(
   return new BrowserViewRendererImpl(client, java_helper);
 }
 
+// static
+BrowserViewRendererImpl* BrowserViewRendererImpl::FromWebContents(
+    content::WebContents* contents) {
+  return UserData::GetInstance(contents);
+}
+
 BrowserViewRendererImpl::BrowserViewRendererImpl(
     BrowserViewRenderer::Client* client,
     JavaHelper* java_helper)
@@ -158,6 +185,7 @@ void BrowserViewRendererImpl::SetAwDrawSWFunctionTable(
 }
 
 void BrowserViewRendererImpl::SetContents(ContentViewCore* content_view_core) {
+  // First remove association from the prior ContentViewCore / WebContents.
   if (web_contents_) {
     ContentViewCore* previous_content_view_core =
         ContentViewCore::FromWebContents(web_contents_);
@@ -165,15 +193,17 @@ void BrowserViewRendererImpl::SetContents(ContentViewCore* content_view_core) {
       previous_content_view_core->RemoveFrameInfoCallback(
           update_frame_info_callback_);
     }
+    web_contents_->SetUserData(kUserDataKey, NULL);
+    DCHECK(!web_contents_);  // WebContentsGone should have been called.
   }
 
-  web_contents_ = content_view_core ?
-                  content_view_core->GetWebContents() : NULL;
-  view_renderer_host_->Observe(web_contents_);
-
   if (!content_view_core)
     return;
 
+  web_contents_ = content_view_core->GetWebContents();
+  web_contents_->SetUserData(kUserDataKey, new UserData(this));
+  view_renderer_host_->Observe(web_contents_);
+
   content_view_core->AddFrameInfoCallback(update_frame_info_callback_);
   dpi_scale_ = content_view_core->GetDpiScale();
 
@@ -182,6 +212,10 @@ void BrowserViewRendererImpl::SetContents(ContentViewCore* content_view_core) {
   Invalidate();
 }
 
+void BrowserViewRendererImpl::WebContentsGone() {
+  web_contents_ = NULL;
+}
+
 void BrowserViewRendererImpl::DrawGL(AwDrawGLInfo* draw_info) {
   TRACE_EVENT0("android_webview", "BrowserViewRendererImpl::DrawGL");
 
diff --git a/android_webview/browser/browser_view_renderer_impl.h b/android_webview/browser/browser_view_renderer_impl.h
index 050645d..3ba2909 100644
--- a/android_webview/browser/browser_view_renderer_impl.h
+++ b/android_webview/browser/browser_view_renderer_impl.h
@@ -38,13 +38,13 @@ class BrowserViewRendererImpl
  public:
   static BrowserViewRendererImpl* Create(BrowserViewRenderer::Client* client,
                                          JavaHelper* java_helper);
-  virtual ~BrowserViewRendererImpl();
-
-  // Platform methods.
+  static BrowserViewRendererImpl* FromWebContents(
+      content::WebContents* contents);
   static void SetAwDrawSWFunctionTable(AwDrawSWFunctionTable* table);
 
+  virtual ~BrowserViewRendererImpl();
+
   // BrowserViewRenderer implementation.
-  // |content_view_core| must not outlive |this| BrowserViewRenderer instance.
   virtual void SetContents(
       content::ContentViewCore* content_view_core) OVERRIDE;
   virtual void DrawGL(AwDrawGLInfo* draw_info) OVERRIDE;
@@ -69,6 +69,9 @@ class BrowserViewRendererImpl
                           JavaHelper* java_helper);
 
  private:
+  class UserData;
+  friend class UserData;
+
   // Returns the latest locally available picture if any.
   // If none is available will synchronously request the latest one
   // and block until the result is received.
@@ -85,6 +88,9 @@ class BrowserViewRendererImpl
                           const gfx::Vector2dF& scroll_offset,
                           float page_scale_factor);
 
+  // Called when |web_contents_| is disconnected from |this| object.
+  void WebContentsGone();
+
   BrowserViewRenderer::Client* client_;
   BrowserViewRenderer::JavaHelper* java_helper_;