Fix WebContentsAccessibilityAndroid lifecycle issue.

After r808115 (http://crrev.com/c/2415928) there was a corner case where
the WebContentsAccessibilityAndroid could change, but the root
BrowserAccessibilityManagerAndroid wouldn't be pointing to it.
This would manifest as TalkBack not speaking in response to the page
changing.

Bug: 1126657, 1131356
Change-Id: I99041aeae4e0fc0d643b86c3e99212dce626b9f4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2425292Reviewed-by: Bo <boliu@chromium.org>
Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#809806}

content/browser/accessibility/web_contents_accessibility_android.cc

@@ -346,6 +346,7 @@ void WebContentsAccessibilityAndroid::Connector::UpdateRenderProcessConnection(
     old_rwhva->SetWebContentsAccessibility(nullptr);
   if (new_rwhva)
     new_rwhva->SetWebContentsAccessibility(accessibility_.get());
+  accessibility_->UpdateBrowserAccessibilityManager();
 }
 
 WebContentsAccessibilityAndroid::WebContentsAccessibilityAndroid(
@@ -355,8 +356,12 @@ WebContentsAccessibilityAndroid::WebContentsAccessibilityAndroid(
     : java_ref_(env, obj),
       web_contents_(static_cast<WebContentsImpl*>(web_contents)),
       frame_info_initialized_(false),
-      use_zoom_for_dsf_enabled_(IsUseZoomForDSFEnabled()),
-      connector_(new Connector(web_contents, this)) {
+      use_zoom_for_dsf_enabled_(IsUseZoomForDSFEnabled()) {
+  // We must initialize this after weak_ptr_factory_ because it can result in
+  // calling UpdateBrowserAccessibilityManager() which accesses
+  // weak_ptr_factory_.
+  connector_ = new Connector(web_contents, this);
+
   CollectStats();
 }
 
@@ -372,6 +377,12 @@ WebContentsAccessibilityAndroid::~WebContentsAccessibilityAndroid() {
   Java_WebContentsAccessibilityImpl_onNativeObjectDestroyed(env, obj);
 }
 
+void WebContentsAccessibilityAndroid::UpdateBrowserAccessibilityManager() {
+  auto* manager = GetRootBrowserAccessibilityManager();
+  if (manager)
+    manager->set_web_contents_accessibility(GetWeakPtr());
+}
+
 void WebContentsAccessibilityAndroid::DeleteEarly(JNIEnv* env) {
   connector_->DeleteEarly();
 }

content/browser/accessibility/web_contents_accessibility_android.h

@@ -39,6 +39,10 @@ class CONTENT_EXPORT WebContentsAccessibilityAndroid
       WebContents* web_contents);
   ~WebContentsAccessibilityAndroid() override;
 
+  // Notify the root BrowserAccessibilityManager that this is the
+  // WebContentsAccessibilityAndroid it should talk to.
+  void UpdateBrowserAccessibilityManager();
+
   // --------------------------------------------------------------------------
   // Methods called from Java via JNI
   // --------------------------------------------------------------------------
@@ -297,7 +301,7 @@ class CONTENT_EXPORT WebContentsAccessibilityAndroid
   // receives accessibility events.
   // Owns itself, and destroyed upon WebContentsObserver::WebContentsDestroyed.
   class Connector;
-  Connector* connector_;
+  Connector* connector_ = nullptr;
 
   base::WeakPtrFactory<WebContentsAccessibilityAndroid> weak_ptr_factory_{this};