Make WebContentsImpl aware of all of its RWHs.

It used to be that WebContentsImpl only knew about the RWHs created
  through WebContentsImpl::CreateNewWidget() and stored them in
  WCI::created_widgets_. However, widgets created through
  FrameTree::CreateRenderViewHost() used to be left out.
This made RenderWidgetHostImpl::WasResized() to incorrectly send
  ViewMsg_Resize while the WebContents was being torn down. WasResized()
  has a check for !delegate_ but |delegate_| never became nullptr during
  WebContentsImpl shutdown. Adding all widgets to WCI::created_widgets_
  will ensure that we notify RWHs about the delegate's (WC) destruction
  via DetachDelegate and do not send ViewMsg_Resize while a the delegate
  (WC) is shutting down.

BUG=523644, 523451
Test=See https://code.google.com/p/chromium/issues/detail?id=523644#c16
  for repro steps. Ensure the renderer does not crash.

Review URL: https://codereview.chromium.org/1457203002

Cr-Commit-Position: refs/heads/master@{#361169}

content/browser/renderer_host/render_widget_host_delegate.h

@@ -39,6 +39,9 @@ struct NativeWebKeyboardEvent;
 //  of the RenderWidgetHost.
 class CONTENT_EXPORT RenderWidgetHostDelegate {
  public:
+  // The RenderWidgetHost has just been created.
+  virtual void RenderWidgetCreated(RenderWidgetHostImpl* render_widget_host) {}
+
   // The RenderWidgetHost is going to be deleted.
   virtual void RenderWidgetDeleted(RenderWidgetHostImpl* render_widget_host) {}
 

content/browser/renderer_host/render_widget_host_impl.cc

@@ -245,6 +245,8 @@ RenderWidgetHostImpl::RenderWidgetHostImpl(RenderWidgetHostDelegate* delegate,
   new_content_rendering_timeout_.reset(new TimeoutMonitor(
       base::Bind(&RenderWidgetHostImpl::ClearDisplayedGraphics,
                  weak_factory_.GetWeakPtr())));
+
+  delegate_->RenderWidgetCreated(this);
 }
 
 RenderWidgetHostImpl::~RenderWidgetHostImpl() {

content/browser/web_contents/web_contents_impl.cc

@@ -1497,17 +1497,20 @@ void WebContentsImpl::LostCapture(RenderWidgetHostImpl* render_widget_host) {
     delegate_->LostCapture();
 }
 
+void WebContentsImpl::RenderWidgetCreated(
+    RenderWidgetHostImpl* render_widget_host) {
+  created_widgets_.insert(render_widget_host);
+}
+
 void WebContentsImpl::RenderWidgetDeleted(
     RenderWidgetHostImpl* render_widget_host) {
-  if (is_being_destroyed_) {
-    // |created_widgets_| might have been destroyed.
-    return;
-  }
+  // Note that |is_being_destroyed_| can be true at this point as
+  // ~WebContentsImpl() calls RFHM::ClearRFHsPendingShutdown(), which might lead
+  // us here.
+  created_widgets_.erase(render_widget_host);
 
-  std::set<RenderWidgetHostImpl*>::iterator iter =
-      created_widgets_.find(render_widget_host);
-  if (iter != created_widgets_.end())
-    created_widgets_.erase(iter);
+  if (is_being_destroyed_)
+    return;
 
   if (render_widget_host &&
       render_widget_host->GetRoutingID() == fullscreen_widget_routing_id_) {
@@ -1923,7 +1926,6 @@ void WebContentsImpl::CreateNewWidget(int32 render_process_id,
 
   RenderWidgetHostImpl* widget_host =
       new RenderWidgetHostImpl(this, process, route_id, IsHidden());
-  created_widgets_.insert(widget_host);
 
   RenderWidgetHostViewBase* widget_view =
       static_cast<RenderWidgetHostViewBase*>(

content/browser/web_contents/web_contents_impl.h

@@ -560,6 +560,7 @@ class CONTENT_EXPORT WebContentsImpl
 
   // RenderWidgetHostDelegate --------------------------------------------------
 
+  void RenderWidgetCreated(RenderWidgetHostImpl* render_widget_host) override;
   void RenderWidgetDeleted(RenderWidgetHostImpl* render_widget_host) override;
   void RenderWidgetGotFocus(RenderWidgetHostImpl* render_widget_host) override;
   void RenderWidgetWasResized(RenderWidgetHostImpl* render_widget_host,