chore: cherry-pick 728c6deeffe1 from chromium

patches/chromium/.patches

@@ -99,3 +99,4 @@ allow_restricted_clock_nanosleep_in_linux_sandbox.patch
 move_readablestream_requests_onto_the_stack_before_iteration.patch
 streams_convert_state_dchecks_to_checks.patch
 cherry-pick-fd211b44535c.patch
+cherry-pick-728c6deeffe1.patch

patches/chromium/cherry-pick-728c6deeffe1.patch

@@ -0,0 +1,43 @@
+From 728c6deeffe1f266bd1639806dd9a27b79e81b1a Mon Sep 17 00:00:00 2001
+From: Kent Tamura <tkent@chromium.org>
+Date: Tue, 25 Feb 2020 01:19:39 +0000
+Subject: [PATCH] Speculative fix for crashes in ~FileChooserImpl()
+
+FileChooserImpl can outlive ListenerProxy.  We should clear
+FileChooserImpl::proxy_ on ~ListenerProxy().
+
+This CL has no tests.  We don't know how to reproduce crashes.
+
+Bug: 1054260
+Change-Id: I2be7a8957f2f725c51081961357ef09f6dabb823
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2067819
+Commit-Queue: Kent Tamura <tkent@chromium.org>
+Reviewed-by: Avi Drissman <avi@chromium.org>
+Reviewed-by: Matthew Denton <mpdenton@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#744142}
+---
+ content/browser/frame_host/render_frame_host_impl.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
+index 4f63d97781f12..4310f69d69c25 100644
+--- a/content/browser/frame_host/render_frame_host_impl.cc
++++ b/content/browser/frame_host/render_frame_host_impl.cc
+@@ -727,6 +727,8 @@ class FileChooserImpl : public blink::mojom::FileChooser,
+     std::move(callback_).Run(nullptr);
+   }
+
++  void ResetProxy() { proxy_ = nullptr; }
++
+  private:
+   class ListenerProxy : public content::FileSelectListener {
+    public:
+@@ -737,6 +739,8 @@ class FileChooserImpl : public blink::mojom::FileChooser,
+           << "Should call either FileSelectListener::FileSelected() or "
+              "FileSelectListener::FileSelectionCanceled()";
+ #endif
++      if (owner_)
++        owner_->ResetProxy();
+     }
+     void ResetOwner() { owner_ = nullptr; }
+