Add unit test to check RFHI::RequestAXTreeSnapshot() with a dead RPH

This CL adds a new unit test to check that the browser process does not
crash if RFHI::RequestAXTreeSnapshot() gets called after the RPH has
died, which would result in a reset (i.e. unbound) mojo::Remote for
the content.mojom.Frame interface.

Bug: 1010831, 1062442
Change-Id: Ib3957ec13d68f2835cffedaa2cdb5e2d51e5594d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2113571Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Commit-Queue: Mario Sanchez Prada <mario@igalia.com>
Cr-Commit-Position: refs/heads/master@{#752835}

content/browser/frame_host/render_frame_host_impl_browsertest.cc

@@ -2811,6 +2811,28 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   EXPECT_FALSE(iframe->AccessibilityIsMainFrame());
 }
 
+IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
+                       RequestSnapshotAXTreeAfterRenderProcessHostDeath) {
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
+  auto* rfh = static_cast<RenderFrameHostImpl*>(
+      shell()->web_contents()->GetMainFrame());
+
+  // Kill the renderer process.
+  RenderProcessHostWatcher crash_observer(
+      rfh->GetProcess(), RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
+  rfh->GetProcess()->Shutdown(0);
+  crash_observer.Wait();
+
+  // Call RequestAXSnapshotTree method. The browser process should not crash.
+  rfh->RequestAXTreeSnapshot(
+      base::BindOnce([](const ui::AXTreeUpdate& snapshot) { NOTREACHED(); }),
+      ui::AXMode::kWebContents);
+
+  base::RunLoop().RunUntilIdle();
+
+  // Pass if this didn't crash.
+}
+
 void FileChooserCallback(base::RunLoop* run_loop,
                          blink::mojom::FileChooserResultPtr result) {
   run_loop->Quit();