GitLab

The crash is caused by a race of WS and KeyboardControllerObserver
mojo interface. When we close keyboard hosting window, we send
OnKeyboardOccludedBoundsChanged and OnKeyboardUIDestroyed via
KeyboardControllerObserver then close the hosting window. But
the browser process could receive the hosting window close via
WS first hence the crash.

The CL wires the unembed code path that happens on hosting window
close with ChromeKeyboardControllerClient::OnKeyboardUIDestroyed.
After OnKeyboardUIDestroyed, the calls on KeyboardControllerObserver
interface will be no-op and the crash would not happen.

Bug: 931910
Change-Id: I2b777a56dca3c26e1f734b732d488165936a291a
Reviewed-on: https://chromium-review.googlesource.com/c/1482948
Commit-Queue: Xiyuan Xia <xiyuan@chromium.org>
Reviewed-by: Steven Bennetts <stevenjb@chromium.org>
Reviewed-by: James Cook <jamescook@chromium.org>
Cr-Commit-Position: refs/heads/master@{#634758}