Do not bind web_contents directly in OnArcHandled

It seems that web_contents may be destroyed during
RunArcExternalProtocolDialog (See TODO comment in the code).
See crashes in crbug.com/1136237

So rather than bind web_contents directly into OnArcHandled(), we use
render_process_host_id and routing_id to look it up at the end as was
happening in ShowFallbackEternalProtocolDialog() prior to
crrev.com/c/2423067.

Bug: 1136237
Change-Id: If0bc1287f9eedbf2b915cd97e049a19f379254ec
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2460067
Commit-Queue: Xiyuan Xia <xiyuan@chromium.org>
Reviewed-by: Xiyuan Xia <xiyuan@chromium.org>
Auto-Submit: Joel Hockey <joelhockey@chromium.org>
Cr-Commit-Position: refs/heads/master@{#815200}

chrome/browser/chromeos/external_protocol_dialog.cc

@@ -32,16 +32,20 @@ namespace {
 
 const int kMessageWidth = 400;
 
-void OnArcHandled(WebContents* web_contents,
-                  const GURL& url,
+void OnArcHandled(const GURL& url,
                   const base::Optional<url::Origin>& initiating_origin,
+                  int render_process_host_id,
+                  int routing_id,
                   bool handled) {
   if (handled)
     return;
 
+  WebContents* web_contents =
+      tab_util::GetWebContentsByID(render_process_host_id, routing_id);
+
   // Display the standard ExternalProtocolDialog if Guest OS has a handler.
-  if (base::FeatureList::IsEnabled(
-          chromeos::features::kGuestOsExternalProtocol)) {
+  if (web_contents && base::FeatureList::IsEnabled(
+                          chromeos::features::kGuestOsExternalProtocol)) {
     base::Optional<guest_os::GuestOsRegistryService::Registration>
         registration = guest_os::GetHandler(
             Profile::FromBrowserContext(web_contents->GetBrowserContext()),
@@ -72,14 +76,15 @@ void ExternalProtocolHandler::RunExternalProtocolDialog(
   // when possible.
   // TODO(ellyjones): Refactor arc::RunArcExternalProtocolDialog() to take a
   // web_contents directly, which will mean sorting out how lifetimes work in
-  // that code.
+  // that code. Same for OnArcHandled() (crbug.com/1136237).
   int render_process_host_id =
       web_contents->GetRenderViewHost()->GetProcess()->GetID();
   int routing_id = web_contents->GetRenderViewHost()->GetRoutingID();
   arc::RunArcExternalProtocolDialog(
       url, initiating_origin, render_process_host_id, routing_id,
       page_transition, has_user_gesture,
-      base::BindOnce(&OnArcHandled, web_contents, url, initiating_origin));
+      base::BindOnce(&OnArcHandled, url, initiating_origin,
+                     render_process_host_id, routing_id));
 }
 
 ///////////////////////////////////////////////////////////////////////////////