Fix an embedder renderer/ crash on <webview> teardown.

I've added the code path to destroy GuestViewContainers on embedder's
  RenderFrame destruction at r333552 in
  GuestViewContainer::RenderFrameDestroyed(). However, this ends up
  calling destruction callback to guest_view_container.js to reset
  the guest's state to GUEST_CREATED. Trying to call this function
  on RenderFrame's destruction ends up failing an assert in
  WebScopedMicroTaskSuppression. We actually do not care about calling
  the destruction callback in this case because the embedder render
  frame is going away anyway. This CL skips calling destruction
  callback in this case.

We already have a test for this that also crashes the renderer/ during
  teardown: WebViewTest.TearDownTest, but unfortunately that test
  doesn't catch the crash while the app is closing and succeeds
  incorrectly.

BUG=498679
Test=Open a chrome app with two <webview>s in it, e.g.
  https://github.com/lazyboy/chromium/tree/master/tests/chrome-apps/webview_input
  Close the app.
  Observer no app crashed notification balloon.

Review URL: https://codereview.chromium.org/1178523006

Cr-Commit-Position: refs/heads/master@{#333830}

3 files changed, 9 insertions, 3 deletions

diff --git a/extensions/renderer/guest_view/extensions_guest_view_container.cc b/extensions/renderer/guest_view/extensions_guest_view_container.cc
index d100503..96650d8 100644
--- a/extensions/renderer/guest_view/extensions_guest_view_container.cc
+++ b/extensions/renderer/guest_view/extensions_guest_view_container.cc
@@ -21,7 +21,13 @@ ExtensionsGuestViewContainer::ExtensionsGuestViewContainer(
 ExtensionsGuestViewContainer::~ExtensionsGuestViewContainer() {
 }
 
-void ExtensionsGuestViewContainer::OnDestroy() {
+void ExtensionsGuestViewContainer::OnDestroy(bool embedder_frame_destroyed) {
+  // Do not attempt to run |destruction_callback_| if the embedder frame was
+  // destroyed. Trying to invoke callback on RenderFrame destruction results in
+  // assertion failure when calling WebScopedMicrotaskSuppression.
+  if (embedder_frame_destroyed)
+    return;
+
   // Call the destruction callback, if one is registered.
   if (!destruction_callback_.IsEmpty()) {
     v8::HandleScope handle_scope(destruction_isolate_);
diff --git a/extensions/renderer/guest_view/extensions_guest_view_container.h b/extensions/renderer/guest_view/extensions_guest_view_container.h
index ec569ac..aabb47e 100644
--- a/extensions/renderer/guest_view/extensions_guest_view_container.h
+++ b/extensions/renderer/guest_view/extensions_guest_view_container.h
@@ -35,7 +35,7 @@ class ExtensionsGuestViewContainer : public guest_view::GuestViewContainer {
   void CallElementResizeCallback(const gfx::Size& new_size);
 
   // GuestViewContainer implementation.
-  void OnDestroy() override;
+  void OnDestroy(bool embedder_frame_destroyed) override;
 
   v8::Global<v8::Function> destruction_callback_;
   v8::Isolate* destruction_isolate_;
diff --git a/extensions/renderer/guest_view/guest_view_internal_custom_bindings.cc b/extensions/renderer/guest_view/guest_view_internal_custom_bindings.cc
index 5f57d5a..82fbd27 100644
--- a/extensions/renderer/guest_view/guest_view_internal_custom_bindings.cc
+++ b/extensions/renderer/guest_view/guest_view_internal_custom_bindings.cc
@@ -198,7 +198,7 @@ void GuestViewInternalCustomBindings::DestroyContainer(
   // GuestViewContainer::DidDestroyElement() currently also destroys
   // a GuestViewContainer. That won't be necessary once GuestViewContainer
   // always runs w/o plugin.
-  guest_view_container->Destroy();
+  guest_view_container->Destroy(false /* embedder_frame_destroyed */);
 }
 
 void GuestViewInternalCustomBindings::GetContentWindow(