Fix nullptr access with MojoInputMessages on.

With event sender input is possibly injected solely on the main thread and
a host may not be bound yet. So protect against null host objects on
the main thread.

BUG=788886

Change-Id: I6b8d1449ce01e3a1f0872133440839fa445d1567
Reviewed-on: https://chromium-review.googlesource.com/793971Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Dave Tapuska <dtapuska@chromium.org>
Cr-Commit-Position: refs/heads/master@{#519746}

content/renderer/input/widget_input_handler_manager.cc

@@ -150,17 +150,23 @@ void WidgetInputHandlerManager::DidOverscroll(
     const gfx::Vector2dF& current_fling_velocity,
     const gfx::PointF& causal_event_viewport_point,
     const cc::ScrollBoundaryBehavior& scroll_boundary_behavior) {
+  mojom::WidgetInputHandlerHost* host = GetWidgetInputHandlerHost();
+  if (!host)
+    return;
   ui::DidOverscrollParams params;
   params.accumulated_overscroll = accumulated_overscroll;
   params.latest_overscroll_delta = latest_overscroll_delta;
   params.current_fling_velocity = current_fling_velocity;
   params.causal_event_viewport_point = causal_event_viewport_point;
   params.scroll_boundary_behavior = scroll_boundary_behavior;
-  GetWidgetInputHandlerHost()->DidOverscroll(params);
+  host->DidOverscroll(params);
 }
 
 void WidgetInputHandlerManager::DidStopFlinging() {
-  GetWidgetInputHandlerHost()->DidStopFlinging();
+  mojom::WidgetInputHandlerHost* host = GetWidgetInputHandlerHost();
+  if (!host)
+    return;
+  host->DidStopFlinging();
 }
 
 void WidgetInputHandlerManager::DidAnimateForInput() {
@@ -189,17 +195,22 @@ void WidgetInputHandlerManager::SetWhiteListedTouchAction(
     cc::TouchAction touch_action,
     uint32_t unique_touch_event_id,
     ui::InputHandlerProxy::EventDisposition event_disposition) {
+  mojom::WidgetInputHandlerHost* host = GetWidgetInputHandlerHost();
+  if (!host)
+    return;
   InputEventAckState ack_state = InputEventDispositionToAck(event_disposition);
-  GetWidgetInputHandlerHost()->SetWhiteListedTouchAction(
-      touch_action, unique_touch_event_id, ack_state);
+  host->SetWhiteListedTouchAction(touch_action, unique_touch_event_id,
+                                  ack_state);
 }
 
 void WidgetInputHandlerManager::ProcessTouchAction(
     cc::TouchAction touch_action) {
   // Cancel the touch timeout on TouchActionNone since it is a good hint
   // that author doesn't want scrolling.
-  if (touch_action == cc::TouchAction::kTouchActionNone)
-    GetWidgetInputHandlerHost()->CancelTouchTimeout();
+  if (touch_action == cc::TouchAction::kTouchActionNone) {
+    if (mojom::WidgetInputHandlerHost* host = GetWidgetInputHandlerHost())
+      host->CancelTouchTimeout();
+  }
 }
 
 mojom::WidgetInputHandlerHost*

content/renderer/render_widget.cc

@@ -1133,8 +1133,10 @@ void RenderWidget::ClearEditCommands() {
 
 void RenderWidget::OnDidOverscroll(const ui::DidOverscrollParams& params) {
   if (widget_input_handler_manager_) {
-    widget_input_handler_manager_->GetWidgetInputHandlerHost()->DidOverscroll(
-        params);
+    if (mojom::WidgetInputHandlerHost* host =
+            widget_input_handler_manager_->GetWidgetInputHandlerHost()) {
+      host->DidOverscroll(params);
+    }
   } else {
     Send(new InputHostMsg_DidOverscroll(routing_id_, params));
   }
@@ -1737,8 +1739,10 @@ void RenderWidget::OnImeSetComposition(
     // process to cancel the input method's ongoing composition session, to make
     // sure we are in a consistent state.
     if (widget_input_handler_manager_) {
-      widget_input_handler_manager_->GetWidgetInputHandlerHost()
-          ->ImeCancelComposition();
+      if (mojom::WidgetInputHandlerHost* host =
+              widget_input_handler_manager_->GetWidgetInputHandlerHost()) {
+        host->ImeCancelComposition();
+      }
     } else {
       Send(new InputHostMsg_ImeCancelComposition(routing_id()));
     }
@@ -2003,9 +2007,11 @@ void RenderWidget::UpdateCompositionInfo(bool immediate_request) {
   composition_character_bounds_ = character_bounds;
   composition_range_ = range;
   if (widget_input_handler_manager_) {
-    widget_input_handler_manager_->GetWidgetInputHandlerHost()
-        ->ImeCompositionRangeChanged(composition_range_,
-                                     composition_character_bounds_);
+    if (mojom::WidgetInputHandlerHost* host =
+            widget_input_handler_manager_->GetWidgetInputHandlerHost()) {
+      host->ImeCompositionRangeChanged(composition_range_,
+                                       composition_character_bounds_);
+    }
   } else {
     Send(new InputHostMsg_ImeCompositionRangeChanged(
         routing_id(), composition_range_, composition_character_bounds_));