Ensure a guest WebContent's view is removed from the InputEventRouter.

content/browser/web_contents/web_contents_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_impl.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/lazy_instance.h"
@@ skipping 400 matching lines @@
                  base::Unretained(this)));
   media_web_contents_observer_.reset(new MediaWebContentsObserver(this));
   wake_lock_service_context_.reset(new WakeLockServiceContext(this));
 }
 
 WebContentsImpl::~WebContentsImpl() {
   is_being_destroyed_ = true;
 
   rwh_input_event_router_.reset();
 
+  // If this WebContents is a guest and goes away before its view has
+  // de-registered its surface id namespace with the outermost WebContent's
+  // input event router (IER), we will lose the ability to ever deregister it,
+  // potentially resulting in a stale pointer in the IER's owner_map_.
+  // Speculative fix for https://crbug.com/570646.
+  auto input_event_router = GetOuterWebContents()
+                                ? GetOuterWebContents()->GetInputEventRouter()
+                                : nullptr;
+  auto render_widget_host_view =
+      static_cast<RenderWidgetHostViewBase*>(GetRenderWidgetHostView());
+  if (input_event_router && render_widget_host_view)
+    input_event_router->RemoveSurfaceIdNamespaceOwner(
+        render_widget_host_view->GetSurfaceIdNamespace());
+
   // Delete all RFH pending shutdown, which will lead the corresponding RVH to
   // shutdown and be deleted as well.
   frame_tree_.ForEach(
       base::Bind(&RenderFrameHostManager::ClearRFHsPendingShutdown));
 
   // Destroy all WebUI instances.
   frame_tree_.ForEach(base::Bind(&RenderFrameHostManager::ClearWebUIInstances));
 
   for (std::set<RenderWidgetHostImpl*>::iterator iter =
            created_widgets_.begin(); iter != created_widgets_.end(); ++iter) {
@@ skipping 4284 matching lines @@
     const WebContentsObserver::MediaPlayerId& id) {
   FOR_EACH_OBSERVER(WebContentsObserver, observers_, MediaStartedPlaying(id));
 }
 
 void WebContentsImpl::MediaStoppedPlaying(
     const WebContentsObserver::MediaPlayerId& id) {
   FOR_EACH_OBSERVER(WebContentsObserver, observers_, MediaStoppedPlaying(id));
 }
 
 }  // namespace content