[WebApps] Removes WebappActivity's TabObserver before tab reparenting.

This fixes a problem where navigating after tab reparenting could cause
WebappActivity's TabObserver to interact with destroyed activity and
crash Chrome due to NPE.

Bug: 771174
Change-Id: I0231ff3c50ebebd8341e5826e3fb6e1a12b69627
Reviewed-on: https://chromium-review.googlesource.com/702075Reviewed-by: Dominick Ng <dominickn@chromium.org>
Commit-Queue: Piotr Swigon <piotrs@chromium.org>
Cr-Commit-Position: refs/heads/master@{#506669}

chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappActivity.java

@@ -82,6 +82,7 @@ public class WebappActivity extends SingleTabActivity {
     protected WebappInfo mWebappInfo;
 
     private WebappSplashScreenController mSplashController;
+    private TabObserver mTabObserver;
 
     private boolean mIsInitialized;
     private Integer mBrandColor;
@@ -153,7 +154,8 @@ public class WebappActivity extends SingleTabActivity {
             if (NetworkChangeNotifier.isOnline()) getActivityTab().reloadIgnoringCache();
         }
 
-        getActivityTab().addObserver(createTabObserver());
+        mTabObserver = createTabObserver();
+        getActivityTab().addObserver(mTabObserver);
         getActivityTab().getTabWebContentsDelegateAndroid().setDisplayMode(
                 mWebappInfo.displayMode());
     }
@@ -638,6 +640,9 @@ public class WebappActivity extends SingleTabActivity {
             url = IntentHandler.getUrlFromIntent(getIntent());
         }
 
+        tab.removeObserver(mTabObserver);
+        mTabObserver = null;
+
         Intent intent = new Intent(Intent.ACTION_VIEW, Uri.parse(url));
         intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
 

chrome/android/javatests/src/org/chromium/chrome/browser/webapps/WebappNavigationTest.java

@@ -21,6 +21,7 @@ import org.junit.runner.RunWith;
 
 import org.chromium.base.ApiCompatibilityUtils;
 import org.chromium.base.ApplicationStatus;
+import org.chromium.base.ThreadUtils;
 import org.chromium.base.test.util.CommandLineFlags;
 import org.chromium.base.test.util.Feature;
 import org.chromium.base.test.util.RetryOnFailure;
@@ -39,6 +40,7 @@ import org.chromium.chrome.test.util.browser.contextmenu.ContextMenuUtils;
 import org.chromium.content.browser.test.util.Criteria;
 import org.chromium.content.browser.test.util.CriteriaHelper;
 import org.chromium.content.browser.test.util.DOMUtils;
+import org.chromium.content_public.browser.LoadUrlParams;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.ui.base.PageTransition;
 
@@ -255,6 +257,31 @@ public class WebappNavigationTest {
         waitForExternalAppOrIntentPicker();
     }
 
+    @Test
+    @SmallTest
+    @Feature({"Webapps"})
+    @RetryOnFailure
+    // Regression test for crbug.com/771174.
+    public void testCanNavigateAfterReparentingToTabbedChrome() throws Exception {
+        runWebappActivityAndWaitForIdle(
+                mActivityTestRule.createIntent()
+                        .putExtra(ShortcutHelper.EXTRA_DISPLAY_MODE, WebDisplayMode.MINIMAL_UI)
+                        .putExtra(ShortcutHelper.EXTRA_THEME_COLOR, (long) Color.CYAN));
+
+        MenuUtils.invokeCustomMenuActionSync(InstrumentationRegistry.getInstrumentation(),
+                mActivityTestRule.getActivity(), R.id.open_in_browser_id);
+
+        ChromeTabbedActivity tabbedChrome = waitFor(ChromeTabbedActivity.class);
+        mActivityTestRule.waitUntilIdle(tabbedChrome);
+
+        ThreadUtils.runOnUiThreadBlocking(
+                () -> tabbedChrome.getActivityTab().loadUrl(new LoadUrlParams(OFF_ORIGIN_URL)));
+
+        mActivityTestRule.waitUntilIdle(tabbedChrome);
+        // Dropping the TLD as Google can redirect to a local site, so this could fail outside US.
+        Assert.assertTrue(tabbedChrome.getActivityTab().getUrl().contains("https://www.google."));
+    }
+
     private void runWebappActivityAndWaitForIdle(Intent intent) throws Exception {
         mActivityTestRule.startWebappActivity(intent.putExtra(
                 ShortcutHelper.EXTRA_URL, mActivityTestRule.getUrlFromTestServer(WEB_APP_PATH)));