MainFrameObserver is inline owned, so it shouldn't be freed by OnDestruct

MainFrameObserver is a RenderFrameObserver and as such is destroyed when
RenderFrame goes away. This happens as part of
RenderFrameObserver::OnDestruct. MainFrameObserver though is inline owned
by WebUIMojo and can be deleted before WebUIMojo is deleted. It results in
use-after-free when WebUIMojo is destructed and tries to free the already
freed MainFrameObserver.

This CL overrides OnDestruct, which allows the MainFrameObserver to stay
alive and be cleaned up by WebUIMojo.

BUG=357747

Review URL: https://codereview.chromium.org/1137533002

Cr-Commit-Position: refs/heads/master@{#328990}

content/renderer/web_ui_mojo.cc

@@ -45,6 +45,9 @@ void WebUIMojo::MainFrameObserver::DidFinishDocumentLoad() {
   web_ui_mojo_->OnDidFinishDocumentLoad();
 }
 
+void WebUIMojo::MainFrameObserver::OnDestruct() {
+}
+
 WebUIMojo::WebUIMojo(RenderView* render_view)
     : RenderViewObserver(render_view),
       RenderViewObserverTracker<WebUIMojo>(render_view),

content/renderer/web_ui_mojo.h

@@ -40,6 +40,11 @@ class WebUIMojo
     void WillReleaseScriptContext(v8::Local<v8::Context> context,
                                   int world_id) override;
     void DidFinishDocumentLoad() override;
+    // MainFrameObserver is inline owned by WebUIMojo and should not be
+    // destroyed when the main RenderFrame is deleted. Overriding the
+    // OnDestruct method allows this object to remain alive and be cleaned
+    // up as part of WebUIMojo deletion.
+    void OnDestruct() override;
 
    private:
     WebUIMojo* web_ui_mojo_;