Fix null pointer crash on hit testing.

The input target receiver should be reset during Close. The widget is
GC'd so it can live longer but we shouldn't receive any messages after
the WidgetBase has been destroyed. This matches the lifecycle of the
receiver_.

BUG=1129309

Change-Id: I4c3a3076e6d03890e59255d471c73d0e59ffe056
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2416391Reviewed-by: David Bokan <bokan@chromium.org>
Commit-Queue: Dave Tapuska <dtapuska@chromium.org>
Cr-Commit-Position: refs/heads/master@{#807926}

third_party/blink/renderer/core/frame/web_frame_widget_base.cc

@@ -210,6 +210,7 @@ void WebFrameWidgetBase::Close(
   widget_base_->Shutdown(std::move(cleanup_runner));
   widget_base_.reset();
   receiver_.reset();
+  input_target_receiver_.reset();
 }
 
 WebLocalFrame* WebFrameWidgetBase::LocalRoot() const {