android: Prevent browser hang in webview.

There has a chance that the |SynchronousCompositorProxy| will re-attach the new
compositor when the RWHWA was reused, and the |SynchronousCompositorControlHost|
will bind failed if the remote has been bound. The browser will hang when send
a |BeginFrame| through the new |SynchronousCompositorHost| but the
|BeginFrameResponse| was sent to the old host control.

Bug:1062576

Change-Id: I0bb953a265a1f1d5b8a445701702c168aa7316f6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2107333Reviewed-by: Timothy Dresser <tdresser@chromium.org>
Reviewed-by: Bo <boliu@chromium.org>
Reviewed-by: Dave Tapuska <dtapuska@chromium.org>
Commit-Queue: Timothy Dresser <tdresser@chromium.org>
Cr-Commit-Position: refs/heads/master@{#751386}

content/browser/android/synchronous_compositor_host.cc

@@ -162,6 +162,9 @@ SynchronousCompositorHost::~SynchronousCompositorHost() {
   if (outstanding_begin_frame_requests_ && begin_frame_source_)
     begin_frame_source_->RemoveObserver(this);
   client_->DidDestroyCompositor(this, frame_sink_id_);
+  // TODO(crbug.com/1062576): We should shutdown the host_control as well since
+  // the Host was disconnected and we should signal all the waiters that we will
+  // never send a |BeginFrame| and expect any |BeginFrameResponse|.
   bridge_->HostDestroyedOnUIThread();
 }
 

content/renderer/input/synchronous_compositor_proxy.cc

@@ -370,6 +370,11 @@ void SynchronousCompositorProxy::BindChannel(
     mojo::PendingAssociatedRemote<mojom::SynchronousCompositorHost> host,
     mojo::PendingAssociatedReceiver<mojom::SynchronousCompositor>
         compositor_request) {
+  // Reset bound mojo channels before rebinding new variants as the
+  // associated RenderWidgetHost may be reused.
+  control_host_.reset();
+  host_.reset();
+  receiver_.reset();
   control_host_.Bind(std::move(control_host));
   host_.Bind(std::move(host));
   receiver_.Bind(std::move(compositor_request));