Make have_emitted_uma_ thread safe in WidgetInputHandlerManager

It is possible for the renderer to navigate and reset the have_emitted_uma_
flag while the compositor thread is processing input and checks the flag.
Make it atomic to avoid this problem.

Bug: 1068119
Change-Id: If6d633f18a6bb645a479cc27317ab6bb99fed708
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2144776Reviewed-by: David Bokan <bokan@chromium.org>
Reviewed-by: Navid Zolghadr <nzolghadr@chromium.org>
Commit-Queue: Navid Zolghadr <nzolghadr@chromium.org>
Auto-Submit: Stephen Chenney <schenney@chromium.org>
Cr-Commit-Position: refs/heads/master@{#758893}

content/renderer/input/widget_input_handler_manager.h

@@ -243,8 +243,10 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
 
   // Control of UMA. We emit one UMA metric per navigation telling us
   // whether any non-move input arrived before we starting updating the page or
-  // displaying content to the user.
-  bool have_emitted_uma_ = false;
+  // displaying content to the user. It must be atomic because navigation can
+  // occur on the renderer thread (resetting this) coincident with the UMA
+  // being sent on the compositor thread.
+  std::atomic<bool> have_emitted_uma_{false};
 
 #if defined(OS_ANDROID)
   std::unique_ptr<SynchronousCompositorProxyRegistry>