[DevTools] Fix crash in WebContentsImpl::ClearDeviceEmulationSize

We are accessing null RenderWidgetHostView. Also added a test which
exposed an issue with emulation commands not being processed when
crashed.

Bug: 818573
Change-Id: Ife852d5323b56d2d08382ef865ac9bf51c5476ff
Reviewed-on: https://chromium-review.googlesource.com/949725Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Commit-Queue: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#540998}

content/browser/devtools/protocol/devtools_protocol_browsertest.cc

@@ -2250,6 +2250,24 @@ IN_PROC_BROWSER_TEST_F(DevToolsProtocolDeviceEmulationTest, MAYBE_DeviceSize) {
   EXPECT_EQ(original_size, GetViewSize());
 }
 
+// Setting frame size (through RWHV) is not supported on Android.
+#if defined(OS_ANDROID)
+#define MAYBE_RenderKillDoesNotCrashBrowser \
+  DISABLED_RenderKillDoesNotCrashBrowser
+#else
+#define MAYBE_RenderKillDoesNotCrashBrowser RenderKillDoesNotCrashBrowser
+#endif
+IN_PROC_BROWSER_TEST_F(DevToolsProtocolDeviceEmulationTest,
+                       MAYBE_RenderKillDoesNotCrashBrowser) {
+  NavigateToURLBlockUntilNavigationsComplete(shell(), GURL("about:blank"), 1);
+  Attach();
+  EmulateDeviceSize(gfx::Size(200, 200));
+  NavigateToURLBlockUntilNavigationsComplete(
+      shell(), GURL(content::kChromeUICrashURL), 1);
+  SendCommand("Emulation.clearDeviceMetricsOverride", nullptr);
+  // Should not crash at this point.
+}
+
 class DevToolsProtocolTouchTest : public DevToolsProtocolTest {
  public:
   ~DevToolsProtocolTouchTest() override {}

content/browser/devtools/protocol/emulation_handler.cc

@@ -265,8 +265,12 @@ Response EmulationHandler::SetDeviceMetricsOverride(
   device_emulation_enabled_ = true;
   device_emulation_params_ = params;
   UpdateDeviceEmulationState();
+
   // Renderer should answer after emulation params were updated, so that the
   // response is only sent to the client once updates were applied.
+  // Unless the renderer has crashed.
+  if (GetWebContents() && GetWebContents()->IsCrashed())
+    return Response::OK();
   return Response::FallThrough();
 }
 
@@ -282,6 +286,9 @@ Response EmulationHandler::ClearDeviceMetricsOverride() {
   UpdateDeviceEmulationState();
   // Renderer should answer after emulation was disabled, so that the response
   // is only sent to the client once updates were applied.
+  // Unless the renderer has crashed.
+  if (GetWebContents() && GetWebContents()->IsCrashed())
+    return Response::OK();
   return Response::FallThrough();
 }
 

content/browser/web_contents/web_contents_impl.cc

@@ -5983,9 +5983,10 @@ void WebContentsImpl::ClearDeviceEmulationSize() {
   // emulation.
   // TODO(jzfeng): Prohibit resizing RWHV through any other means (at least when
   // WebContentsView size changes).
-  if (!view_size_before_emulation_.IsEmpty() &&
-      rwhv->GetViewBounds().size() == device_emulation_size_)
+  if (!view_size_before_emulation_.IsEmpty() && rwhv &&
+      rwhv->GetViewBounds().size() == device_emulation_size_) {
     rwhv->SetSize(view_size_before_emulation_);
+  }
   device_emulation_size_ = gfx::Size();
   view_size_before_emulation_ = gfx::Size();
 }