weblayer: fix crash in Tab

ComposedBrowserControlsVisibilityDelegate (by way of ObservableSupplierImpl)
may post a task to notify the observer (the Tab in this case). If the Tab is
destroyed before the task runs, then when the task runs we get a crash as
the Tab has been destroyed (specifically mNativeTab is 0, which means the jni
call DCHECKs).

I would like a test for this, but it proved slightly tricky.

BUG=1057657
TEST=none

Change-Id: I85534c464fe11121fb9f65710fc3fb69b48b0d68
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2083813Reviewed-by: Evan Stade <estade@chromium.org>
Commit-Queue: Scott Violet <sky@chromium.org>
Cr-Commit-Position: refs/heads/master@{#746113}

weblayer/browser/java/org/chromium/weblayer_private/TabImpl.java

@@ -492,6 +492,10 @@ public final class TabImpl extends ITab.Stub {
             mNewTabCallbackProxy.destroy();
             mNewTabCallbackProxy = null;
         }
+        // ObservableSupplierImpl.addObserver() posts a task to notify the observer, ensure the
+        // callback isn't run after destroy() is called (otherwise we'll get crashes as the native
+        // tab has been deleted).
+        mBrowserControlsVisibility.removeObserver(mConstraintsUpdatedCallback);
         hideFindInPageUiAndNotifyClient();
         mFindInPageCallbackClient = null;
         mNavigationController = null;