Remove unsafe access in dtor

Oilpan destruction order is non-deterministic, and it is unsafe to
access other on-heap objects from a dtor.

This CL removes such accesses, in favor of letting Oilpan clear out
WeakMembers automatically.

If threading issues or other crashes happen, the USING_PRE_FINALIZER
macro should be used for cleanup instead.

Bug: 1137555, 1137557, 1137588
Change-Id: I97fed30743f7000e296b94a29d02e2cfa5c034b8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2468188
Commit-Queue: Thomas Guilbert <tguilbert@chromium.org>
Commit-Queue: Klaus Weidner <klausw@chromium.org>
Auto-Submit: Thomas Guilbert <tguilbert@chromium.org>
Reviewed-by: Klaus Weidner <klausw@chromium.org>
Cr-Commit-Position: refs/heads/master@{#816720}

third_party/blink/renderer/modules/video_rvfc/video_frame_callback_requester_impl.cc

@@ -48,14 +48,7 @@ VideoFrameCallbackRequesterImpl::VideoFrameCallbackRequesterImpl(
           MakeGarbageCollected<VideoFrameRequestCallbackCollection>(
               element.GetExecutionContext())) {}
 
-VideoFrameCallbackRequesterImpl::~VideoFrameCallbackRequesterImpl() {
-  if (!observing_immersive_session_)
-    return;
-
-  auto* frame_provider = GetXRFrameProvider();
-  if (frame_provider)
-    frame_provider->RemoveImmersiveSessionObserver(this);
-}
+VideoFrameCallbackRequesterImpl::~VideoFrameCallbackRequesterImpl() = default;
 
 // static
 VideoFrameCallbackRequesterImpl& VideoFrameCallbackRequesterImpl::From(

third_party/blink/renderer/modules/xr/xr_frame_provider.cc

@@ -65,11 +65,6 @@ void XRFrameProvider::AddImmersiveSessionObserver(
   immersive_observers_.insert(observer);
 }
 
-void XRFrameProvider::RemoveImmersiveSessionObserver(
-    ImmersiveSessionObserver* observer) {
-  immersive_observers_.erase(observer);
-}
-
 void XRFrameProvider::OnSessionStarted(
     XRSession* session,
     device::mojom::blink::XRSessionPtr session_ptr) {

third_party/blink/renderer/modules/xr/xr_frame_provider.h

@@ -62,8 +62,9 @@ class XRFrameProvider final : public GarbageCollected<XRFrameProvider> {
     return immersive_data_provider_.get();
   }
 
+  // Adds an ImmersiveSessionObserver. Observers will be automatically removed
+  // by Oilpan when they are destroyed, and their WeakMember becomes null.
   void AddImmersiveSessionObserver(ImmersiveSessionObserver*);
-  void RemoveImmersiveSessionObserver(ImmersiveSessionObserver*);
 
   virtual void Trace(Visitor*) const;
 
@@ -115,6 +116,9 @@ class XRFrameProvider final : public GarbageCollected<XRFrameProvider> {
       immersive_presentation_provider_;
   device::mojom::blink::VRPosePtr immersive_frame_pose_;
   bool is_immersive_frame_position_emulated_ = false;
+
+  // Note: Oilpan automatically removes destroyed observers from
+  // |immersive_observers_| and does not need an explicit removal.
   HeapHashSet<WeakMember<ImmersiveSessionObserver>> immersive_observers_;
 
   // Time the first immersive frame has arrived - used to align the monotonic