Remove FullscreenManager accesses after it is nulled out in ChromeActivity

Crash 1:
https://crash.corp.google.com/browse?q=expanded_custom_data.ChromeCrashProto.magic_signature_1.name%3D%27%5BAndroid+Java+Exception%5D+java.lang.RuntimeException+at+org.chromium.chrome.browser.ChromeActivity.getFullscreenManager%28ChromeActivity.java%29%27+AND+product_name%3D%27Chrome_Android%27#-propertyselector,productname:1000,productversion:100,magicsignature:50,magicsignature2:50,stablesignature:50,magicsignaturesorted:50

Crash 2:
https://crash.corp.google.com/browse?q=product_name%3D%27Chrome_Android%27+AND+product.version%3D%2773.0.3683.37%27+AND+expanded_custom_data.ChromeCrashProto.channel%3D%27beta%27+AND+expanded_custom_data.ChromeCrashProto.ptype%3D%27browser%27+AND+expanded_custom_data.ChromeCrashProto.magic_signature_1.name%3D%27%5BAndroid+Java+Exception%5D+java.lang.IllegalStateException+at+org.chromium.chrome.browser.ChromeActivity.getFullscreenManager%28ChromeActivity.java%29%27

Plus potential similar crash in TWAs

Bug: 938212
Change-Id: Icd183741ea042f7d4c491a4755acc7fd4aff5050
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1503256Reviewed-by: Ted Choc <tedchoc@chromium.org>
Reviewed-by: Peter Conn <peconn@chromium.org>
Commit-Queue: Pavel Shmakov <pshmakov@chromium.org>
Cr-Commit-Position: refs/heads/master@{#638069}

chrome/android/features/vr/java/src/org/chromium/chrome/browser/vr/VrShell.java

@@ -773,7 +773,9 @@ public class VrShell extends GvrLayout
             removeVrRootView();
         }
 
-        mActivity.getFullscreenManager().exitPersistentFullscreenMode();
+        if (!mActivity.isActivityFinishingOrDestroyed()) {
+            mActivity.getFullscreenManager().exitPersistentFullscreenMode();
+        }
         reparentAllTabs(mActivity.getWindowAndroid());
         if (mNativeVrShell != 0) {
             nativeDestroy(mNativeVrShell);

chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java

@@ -1288,6 +1288,9 @@ public class ChromeTabbedActivity
         public void processUrlViewIntent(String url, String referer, String headers,
                 @TabOpenType int tabOpenType, String externalAppId, int tabIdToBringToFront,
                 boolean hasUserGesture, Intent intent) {
+            if (isActivityFinishingOrDestroyed()) {
+                return;
+            }
             if (isFromChrome(intent, externalAppId)) {
                 RecordUserAction.record("MobileTabbedModeViewIntentFromChrome");
             } else {

chrome/android/java/src/org/chromium/chrome/browser/browserservices/OriginVerifier.java

@@ -9,6 +9,7 @@ import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
 import android.net.Uri;
 import android.support.annotation.NonNull;
+import android.support.annotation.Nullable;
 import android.support.customtabs.CustomTabsService;
 import android.support.customtabs.CustomTabsService.Relation;
 import android.text.TextUtils;
@@ -67,7 +68,7 @@ public class OriginVerifier {
     private final String mSignatureFingerprint;
     private final @Relation int mRelation;
     private long mNativeOriginVerifier;
-    private OriginVerificationListener mListener;
+    @Nullable private OriginVerificationListener mListener;
     private Origin mOrigin;
 
     /**
@@ -274,6 +275,13 @@ public class OriginVerifier {
         }
     }
 
+    /**
+     * Removes the verification listener, but finishes the ongoing verification process, if any.
+     */
+    public void removeListener() {
+        mListener = null;
+    }
+
     private static boolean shouldOverrideVerification(String packageName, Origin origin,
             int relation) {
         if (sVerificationOverrides.get() == null) return false;

chrome/android/java/src/org/chromium/chrome/browser/browserservices/trustedwebactivityui/controller/TrustedWebActivityVerifier.java

@@ -19,6 +19,7 @@ import org.chromium.chrome.browser.customtabs.CustomTabsConnection;
 import org.chromium.chrome.browser.customtabs.TabObserverRegistrar;
 import org.chromium.chrome.browser.dependency_injection.ActivityScope;
 import org.chromium.chrome.browser.init.ActivityLifecycleDispatcher;
+import org.chromium.chrome.browser.lifecycle.Destroyable;
 import org.chromium.chrome.browser.lifecycle.NativeInitObserver;
 import org.chromium.chrome.browser.tab.EmptyTabObserver;
 import org.chromium.chrome.browser.tab.Tab;
@@ -40,7 +41,7 @@ import dagger.Lazy;
  * {@link TrustedWebActivityModel} accordingly.
  */
 @ActivityScope
-public class TrustedWebActivityVerifier implements NativeInitObserver {
+public class TrustedWebActivityVerifier implements NativeInitObserver, Destroyable {
     /** The Digital Asset Link relationship used for Trusted Web Activities. */
     private final static int RELATIONSHIP = CustomTabsService.RELATION_HANDLE_ALL_URLS;
 
@@ -208,6 +209,12 @@ public class TrustedWebActivityVerifier implements NativeInitObserver {
         }
     }
 
+    @Override
+    public void destroy() {
+        // Verification may finish after activity is destroyed.
+        mOriginVerifier.removeListener();
+    }
+
     /**
      * Register that we have Chrome data relevant to the Client app.
      *

chrome/android/java/src/org/chromium/chrome/browser/browserservices/trustedwebactivityui/view/TrustedWebActivityToolbarView.java

@@ -6,6 +6,7 @@ package org.chromium.chrome.browser.browserservices.trustedwebactivityui.view;
 
 import static org.chromium.chrome.browser.browserservices.trustedwebactivityui.TrustedWebActivityModel.TOOLBAR_HIDDEN;
 
+import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.browserservices.trustedwebactivityui.TrustedWebActivityModel;
 import org.chromium.chrome.browser.customtabs.CustomTabBrowserControlsVisibilityDelegate;
 import org.chromium.chrome.browser.dependency_injection.ActivityScope;
@@ -27,21 +28,27 @@ public class TrustedWebActivityToolbarView implements
     private final Lazy<ChromeFullscreenManager> mFullscreenManager;
     private final CustomTabBrowserControlsVisibilityDelegate mControlsVisibilityDelegate;
     private final TrustedWebActivityModel mModel;
+    private final ChromeActivity mActivity;
 
     private int mControlsHidingToken = FullscreenManager.INVALID_TOKEN;
 
     @Inject
     public TrustedWebActivityToolbarView(Lazy<ChromeFullscreenManager> fullscreenManager,
             CustomTabBrowserControlsVisibilityDelegate controlsVisibilityDelegate,
-            TrustedWebActivityModel model) {
+            TrustedWebActivityModel model, ChromeActivity activity) {
         mFullscreenManager = fullscreenManager;
         mControlsVisibilityDelegate = controlsVisibilityDelegate;
         mModel = model;
+        mActivity = activity;
         mModel.addObserver(this);
     }
 
     @Override
     public void onPropertyChanged(PropertyObservable<PropertyKey> observable, PropertyKey key) {
+        if (mActivity.isActivityFinishingOrDestroyed()) {
+            assert false : "Tried to change toolbar visibility when activity is destroyed";
+            return;
+        }
         if (key != TOOLBAR_HIDDEN) return;
 
         boolean hide = mModel.get(TOOLBAR_HIDDEN);