android: Fix ContentViewCore and RenderWidgetHostViewAndroid lifetime issue

https://codereview.chromium.org/26753005/ might have introduced crashes that
trace to SetContentViewCore.  That previous patch assumed that ContentViewCore
(CVC) always outlives its associated RenderWidgetHostView.  In this patch, we
are trying to ensure that the RWHVA pointer to CVC is nulled when CVC is
destroyed.

Note the following:
- WebContents owns ContentViewCore and WebContentsView.
- CVC and WebContentsView are implicitly destroyed (no direct call to clean-up
code).  So ContentViewCore cannot refer to WebContents or WebContentsView in
its destructor.

Therefore, we use the observer of when WebContents is destroyed to start the
clean up on CVC.


BUG=335165, 324341

Review URL: https://codereview.chromium.org/133073012

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@247878 0039d316-1c4b-4281-b951-d872f2087c98

content/browser/android/content_view_core_impl.cc

@@ -1693,6 +1693,13 @@ void ContentViewCoreImpl::OnSmartClipDataExtracted(
       env, obj.obj(), jresult.obj());
 }
 
+void ContentViewCoreImpl::WebContentsDestroyed(WebContents* web_contents) {
+  WebContentsViewAndroid* wcva =
+      static_cast<WebContentsViewAndroid*>(web_contents->GetView());
+  DCHECK(wcva);
+  wcva->SetContentViewCore(NULL);
+}
+
 // This is called for each ContentView.
 jlong Init(JNIEnv* env,
            jobject obj,

content/browser/android/content_view_core_impl.h

@@ -334,6 +334,7 @@ class ContentViewCoreImpl : public ContentViewCore,
 
   // WebContentsObserver implementation.
   virtual void RenderViewReady() OVERRIDE;
+  virtual void WebContentsDestroyed(WebContents* web_contents) OVERRIDE;
 
   // --------------------------------------------------------------------------
   // Other private methods and data