Fix for crash in GuestViewBase::FindReply.

There are two problems here:

1) The GuestViewBase received a FindReply while its WebContents was in the process of being destroyed. This patch adds a check in WebContentsImpl::NotifyFindReply to prevent this.

2) During destruction of GuestViewBase, there is a period of time when there is no owner WebContents, but attached() still returns true. This patch ensures that that attached() will return false as soon as |owner_web_contents_| is cleared.

BUG=642733

Review-Url: https://codereview.chromium.org/2300663002
Cr-Commit-Position: refs/heads/master@{#415697}

components/guest_view/browser/guest_view_base.cc

@@ -478,6 +478,8 @@ void GuestViewBase::Destroy() {
   StopTrackingEmbedderZoomLevel();
   owner_web_contents_ = nullptr;
 
+  element_instance_id_ = kInstanceIDNone;
+
   DCHECK(web_contents());
 
   // Give the derived class an opportunity to perform some cleanup.

content/browser/web_contents/web_contents_impl.cc

@@ -5107,7 +5107,7 @@ void WebContentsImpl::NotifyFindReply(int request_id,
                                       const gfx::Rect& selection_rect,
                                       int active_match_ordinal,
                                       bool final_update) {
-  if (delegate_) {
+  if (delegate_ && !is_being_destroyed_) {
     delegate_->FindReply(this, request_id, number_of_matches, selection_rect,
                          active_match_ordinal, final_update);
   }