Speculative fix for crashes in ~FileChooserImpl()

FileChooserImpl can outlive ListenerProxy.  We should clear
FileChooserImpl::proxy_ on ~ListenerProxy().

This CL has no tests.  We don't know how to reproduce crashes.

Bug: 1054260
Change-Id: I2be7a8957f2f725c51081961357ef09f6dabb823
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2067819
Commit-Queue: Kent Tamura <tkent@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Reviewed-by: Matthew Denton <mpdenton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#744142}

content/browser/frame_host/render_frame_host_impl.cc

@@ -727,6 +727,8 @@ class FileChooserImpl : public blink::mojom::FileChooser,
     std::move(callback_).Run(nullptr);
   }
 
+  void ResetProxy() { proxy_ = nullptr; }
+
  private:
   class ListenerProxy : public content::FileSelectListener {
    public:
@@ -737,6 +739,8 @@ class FileChooserImpl : public blink::mojom::FileChooser,
           << "Should call either FileSelectListener::FileSelected() or "
              "FileSelectListener::FileSelectionCanceled()";
 #endif
+      if (owner_)
+        owner_->ResetProxy();
     }
     void ResetOwner() { owner_ = nullptr; }