Fix crash in FlingSchedulerAndroid

Stop observing the ui::WindowAndroid when its compositor has detached.
This should prevent us from calling into it once it's destroyed.

Bug: 869775,868849,865118
Change-Id: I75b4351f76f029a33c5ce6c9fc10b39f050fc750
Reviewed-on: https://chromium-review.googlesource.com/1170857Reviewed-by: Sahel Sharify <sahel@chromium.org>
Reviewed-by: Dave Tapuska <dtapuska@chromium.org>
Commit-Queue: Saman Sami <samans@chromium.org>
Cr-Commit-Position: refs/heads/master@{#582661}

content/browser/renderer_host/input/fling_scheduler_android.cc

@@ -67,6 +67,13 @@ ui::WindowAndroid* FlingSchedulerAndroid::GetRootWindow() {
   return host_->GetView()->GetNativeView()->GetWindowAndroid();
 }
 
+void FlingSchedulerAndroid::OnDetachCompositor() {
+  // Once the window's compositor has detached, we will no longer receive
+  // OnAnimate calls. Stop observing the window.
+  observed_window_->RemoveObserver(this);
+  observed_window_ = nullptr;
+}
+
 void FlingSchedulerAndroid::OnAnimate(base::TimeTicks frame_begin_time) {
   DCHECK(observed_window_);
   if (fling_controller_)

content/browser/renderer_host/input/fling_scheduler_android.h

@@ -40,7 +40,7 @@ class CONTENT_EXPORT FlingSchedulerAndroid : public FlingSchedulerBase,
   void OnCompositingDidCommit() override {}
   void OnRootWindowVisibilityChanged(bool visible) override {}
   void OnAttachCompositor() override {}
-  void OnDetachCompositor() override {}
+  void OnDetachCompositor() override;
   void OnAnimate(base::TimeTicks frame_begin_time) override;
   void OnActivityStopped() override {}
   void OnActivityStarted() override {}