Fix racy TouchActionBrowserTest

The usage of RenderFrameSubmissionObserver in TouchActionBrowserTest is racy.
This change updates the ownership of the observer to avoid that.

Bug: 760181
Change-Id: I23eaab201d478a6a8948893f10158e8c9c4c4d44
Reviewed-on: https://chromium-review.googlesource.com/964241Reviewed-by: Timothy Dresser <tdresser@chromium.org>
Commit-Queue: Jonathan Ross <jonross@chromium.org>
Cr-Commit-Position: refs/heads/master@{#544066}

content/browser/renderer_host/input/touch_action_browsertest.cc

@@ -91,7 +91,7 @@ class TouchActionBrowserTest : public ContentBrowserTest {
     NavigateToURL(shell(), data_url);
 
     RenderWidgetHostImpl* host = GetWidgetHost();
-    RenderFrameSubmissionObserver frame_observer(
+    frame_observer_ = std::make_unique<RenderFrameSubmissionObserver>(
         host->render_frame_metadata_provider());
     host->GetView()->SetSize(gfx::Size(400, 400));
 
@@ -103,7 +103,7 @@ class TouchActionBrowserTest : public ContentBrowserTest {
     // otherwise the injection of the synthetic gestures may get
     // dropped because of MainThread/Impl thread sync of touch event
     // regions.
-    frame_observer.WaitForAnyFrameSubmission();
+    frame_observer_->WaitForAnyFrameSubmission();
   }
 
   // ContentBrowserTest:
@@ -115,6 +115,13 @@ class TouchActionBrowserTest : public ContentBrowserTest {
     cmd->AppendSwitch(switches::kEnableExperimentalWebPlatformFeatures);
   }
 
+  // ContentBrowserTest:
+  void PostRunTestOnMainThread() override {
+    // Delete this before the WebContents is destroyed.
+    frame_observer_.reset();
+    ContentBrowserTest::PostRunTestOnMainThread();
+  }
+
   int ExecuteScriptAndExtractInt(const std::string& script) {
     int value = 0;
     EXPECT_TRUE(content::ExecuteScriptAndExtractInt(
@@ -145,9 +152,6 @@ class TouchActionBrowserTest : public ContentBrowserTest {
         ExecuteScriptAndExtractInt("document.documentElement.scrollHeight");
     EXPECT_EQ(10200, scroll_height);
 
-    RenderFrameSubmissionObserver frame_metadata_observer(
-        GetWidgetHost()->render_frame_metadata_provider());
-
     SyntheticSmoothScrollGestureParams params;
     params.gesture_source_type = SyntheticGestureParams::TOUCH_INPUT;
     params.anchor = gfx::PointF(point);
@@ -170,10 +174,10 @@ class TouchActionBrowserTest : public ContentBrowserTest {
     // main thread was in a busy loop.
     gfx::Vector2dF default_scroll_offset;
     while (wait_until_scrolled &&
-           frame_metadata_observer.LastRenderFrameMetadata()
+           frame_observer_->LastRenderFrameMetadata()
                    .root_scroll_offset.value_or(default_scroll_offset)
                    .y() < (distance.y() / 2)) {
-      frame_metadata_observer.WaitForMetadataChange();
+      frame_observer_->WaitForMetadataChange();
     }
 
     // Check the scroll offset
@@ -187,6 +191,7 @@ class TouchActionBrowserTest : public ContentBrowserTest {
   }
 
  private:
+  std::unique_ptr<RenderFrameSubmissionObserver> frame_observer_;
   scoped_refptr<MessageLoopRunner> runner_;
 
   DISALLOW_COPY_AND_ASSIGN(TouchActionBrowserTest);