Android: Fix NPE around FullscreenManager

TabBrowserControlsOffsetHelper is Tab UserData which should not
be accessed after the tab is destroyed. This was not taken
into account when referenced in ChromeFullscreenManager. This CL
adds the missing check against Tab for its state, and also
ensures the tab reference in the manager is set to null on
its destruction.

Bug: 897922
Change-Id: I20f0c5e87de1b3c7025d88ccfc00b7d157c6975c
Reviewed-on: https://chromium-review.googlesource.com/c/1297856
Commit-Queue: Jinsuk Kim <jinsukkim@chromium.org>
Reviewed-by: Ted Choc <tedchoc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#603412}

chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java

@@ -1301,11 +1301,6 @@ public abstract class ChromeActivity<C extends ChromeActivityComponent>
             mBottomSheet = null;
         }
 
-        if (mTabModelsInitialized) {
-            TabModelSelector selector = getTabModelSelector();
-            if (selector != null) selector.destroy();
-        }
-
         if (mDidAddPolicyChangeListener) {
             CombinedPolicyProvider.get().removePolicyChangeListener(this);
             mDidAddPolicyChangeListener = false;
@@ -1328,6 +1323,11 @@ public abstract class ChromeActivity<C extends ChromeActivityComponent>
             mFullscreenManager = null;
         }
 
+        if (mTabModelsInitialized) {
+            TabModelSelector selector = getTabModelSelector();
+            if (selector != null) selector.destroy();
+        }
+
         AccessibilityManager manager = (AccessibilityManager)
                 getBaseContext().getSystemService(Context.ACCESSIBILITY_SERVICE);
         manager.removeAccessibilityStateChangeListener(this);

chrome/android/java/src/org/chromium/chrome/browser/fullscreen/ChromeFullscreenManager.java

@@ -570,9 +570,16 @@ public class ChromeFullscreenManager
         if (mHidingTokenHolder.hasTokens()) {
             return false;
         }
-        if (getTab() != null
-                && TabBrowserControlsOffsetHelper.from(getTab()).isControlsOffsetOverridden()) {
-            return true;
+
+        Tab tab = getTab();
+        if (tab != null) {
+            if (tab.isInitialized()) {
+                if (TabBrowserControlsOffsetHelper.from(tab).isControlsOffsetOverridden()) {
+                    return true;
+                }
+            } else {
+                assert false : "Accessing a destroyed tab, setTab should have been called";
+            }
         }
 
         boolean showControls = !drawControlsAsTexture();

chrome/android/java/src/org/chromium/chrome/browser/fullscreen/FullscreenManager.java

@@ -192,5 +192,7 @@ public abstract class FullscreenManager {
     /**
      * Destroys the FullscreenManager
      */
-    public void destroy() {}
+    public void destroy() {
+        setTab(null);
+    }
 }