Speculative fix for possible invalid observer dereference.

When an OOPIF touch selection controller client invalidates itself, it
needs to remove its observer. Otherwise we could end up in a situation
where, during shutdown, the manager itself goes away but is still
registered as an observer with the FrameSinkManager.

Bug: 897616
Change-Id: I9eac1b5d876a1b00784fee7a107dc0777bf624aa
Reviewed-on: https://chromium-review.googlesource.com/c/1293750Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Commit-Queue: James MacLean <wjmaclean@chromium.org>
Cr-Commit-Position: refs/heads/master@{#601608}

content/browser/renderer_host/input/touch_selection_controller_client_manager_android.cc

@@ -74,8 +74,11 @@ void TouchSelectionControllerClientManagerAndroid::UpdateClientSelectionBounds(
 
 void TouchSelectionControllerClientManagerAndroid::InvalidateClient(
     ui::TouchSelectionControllerClient* client) {
-  if (active_client_ == client)
+  if (active_client_ == client) {
+    if (active_client_ != rwhv_)
+      host_frame_sink_manager_->RemoveHitTestRegionObserver(this);
     active_client_ = rwhv_;
+  }
 }
 
 ui::TouchSelectionController*