Fix race on Mojo Input Message based host_ callback object.

The host_ ptr was only populated on the Widget's input handler interface
and if an event was received before that binding wasn't completed before
the first touch start was received and a null host would be accessed.

Add the host interface to the frame input handler interface so that there
is no race. Whenever input is handled there will be a host.

BUG=774340

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_site_isolation
Change-Id: I514d97c13f260f8af7d0224de9aa7c6488c67f80
Reviewed-on: https://chromium-review.googlesource.com/742082
Commit-Queue: Dave Tapuska <[email protected]>
Reviewed-by: Daniel Cheng <[email protected]>
Reviewed-by: Nick Carter <[email protected]>
Cr-Commit-Position: refs/heads/master@{#516729}
diff --git a/content/browser/frame_host/input/legacy_ipc_frame_input_handler.cc b/content/browser/frame_host/input/legacy_ipc_frame_input_handler.cc
index 322b6521..592c24e 100644
--- a/content/browser/frame_host/input/legacy_ipc_frame_input_handler.cc
+++ b/content/browser/frame_host/input/legacy_ipc_frame_input_handler.cc
@@ -153,7 +153,8 @@
 }
 
 void LegacyIPCFrameInputHandler::GetWidgetInputHandler(
-    mojom::WidgetInputHandlerAssociatedRequest interface_request) {
+    mojom::WidgetInputHandlerAssociatedRequest interface_request,
+    mojom::WidgetInputHandlerHostPtr host) {
   NOTREACHED();
 }
 
diff --git a/content/browser/frame_host/input/legacy_ipc_frame_input_handler.h b/content/browser/frame_host/input/legacy_ipc_frame_input_handler.h
index 4f56627..8fc6bf9 100644
--- a/content/browser/frame_host/input/legacy_ipc_frame_input_handler.h
+++ b/content/browser/frame_host/input/legacy_ipc_frame_input_handler.h
@@ -53,7 +53,8 @@
   void ScrollFocusedEditableNodeIntoRect(const gfx::Rect& rect) override;
   void MoveCaret(const gfx::Point& point) override;
   void GetWidgetInputHandler(
-      mojom::WidgetInputHandlerAssociatedRequest interface_request) override;
+      mojom::WidgetInputHandlerAssociatedRequest interface_request,
+      mojom::WidgetInputHandlerHostPtr host) override;
 
  private:
   void SendInput(std::unique_ptr<IPC::Message> message);
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 4056f81..5f61615 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -531,9 +531,12 @@
         RenderWidgetHostImpl::FromID(GetProcess()->GetID(), widget_routing_id);
 
     mojom::WidgetInputHandlerAssociatedPtr widget_handler;
+    mojom::WidgetInputHandlerHostRequest host_request;
     if (frame_input_handler_) {
+      mojom::WidgetInputHandlerHostPtr host;
+      host_request = mojo::MakeRequest(&host);
       frame_input_handler_->GetWidgetInputHandler(
-          mojo::MakeRequest(&widget_handler));
+          mojo::MakeRequest(&widget_handler), std::move(host));
     }
     if (!render_widget_host_) {
       DCHECK(frame_tree_node->parent());
@@ -546,7 +549,8 @@
       DCHECK(!render_widget_host_->owned_by_render_frame_host());
       render_widget_host_->SetWidget(std::move(widget));
     }
-    render_widget_host_->SetWidgetInputHandler(std::move(widget_handler));
+    render_widget_host_->SetWidgetInputHandler(std::move(widget_handler),
+                                               std::move(host_request));
     render_widget_host_->input_router()->SetFrameTreeNodeId(
         frame_tree_node_->frame_tree_node_id());
   }
@@ -1234,9 +1238,13 @@
 
     if (frame_input_handler_) {
       mojom::WidgetInputHandlerAssociatedPtr widget_handler;
+      mojom::WidgetInputHandlerHostPtr host;
+      mojom::WidgetInputHandlerHostRequest host_request =
+          mojo::MakeRequest(&host);
       frame_input_handler_->GetWidgetInputHandler(
-          mojo::MakeRequest(&widget_handler));
-      render_widget_host_->SetWidgetInputHandler(std::move(widget_handler));
+          mojo::MakeRequest(&widget_handler), std::move(host));
+      render_widget_host_->SetWidgetInputHandler(std::move(widget_handler),
+                                                 std::move(host_request));
     }
 
     render_widget_host_->InitForFrame();
diff --git a/content/browser/renderer_host/input/input_router.h b/content/browser/renderer_host/input/input_router.h
index 6df7306..68a5493 100644
--- a/content/browser/renderer_host/input/input_router.h
+++ b/content/browser/renderer_host/input/input_router.h
@@ -64,7 +64,8 @@
   virtual void SetForceEnableZoom(bool enabled) = 0;
 
   // Associate this InputRouter with a remote host channel.
-  virtual void BindHost(mojom::WidgetInputHandlerHostRequest request) = 0;
+  virtual void BindHost(mojom::WidgetInputHandlerHostRequest request,
+                        bool frame_handler) = 0;
 };
 
 }  // namespace content
diff --git a/content/browser/renderer_host/input/input_router_impl.cc b/content/browser/renderer_host/input/input_router_impl.cc
index d6dc10a2..2f3ded5 100644
--- a/content/browser/renderer_host/input/input_router_impl.cc
+++ b/content/browser/renderer_host/input/input_router_impl.cc
@@ -85,6 +85,7 @@
       gesture_event_queue_(this, this, config.gesture_config),
       device_scale_factor_(1.f),
       host_binding_(this),
+      frame_host_binding_(this),
       weak_ptr_factory_(this) {
   weak_this_ = weak_ptr_factory_.GetWeakPtr();
 
@@ -191,9 +192,15 @@
   return touch_action_filter_.allowed_touch_action();
 }
 
-void InputRouterImpl::BindHost(mojom::WidgetInputHandlerHostRequest request) {
-  host_binding_.Close();
-  host_binding_.Bind(std::move(request));
+void InputRouterImpl::BindHost(mojom::WidgetInputHandlerHostRequest request,
+                               bool frame_handler) {
+  if (frame_handler) {
+    frame_host_binding_.Close();
+    frame_host_binding_.Bind(std::move(request));
+  } else {
+    host_binding_.Close();
+    host_binding_.Bind(std::move(request));
+  }
 }
 
 void InputRouterImpl::CancelTouchTimeout() {
diff --git a/content/browser/renderer_host/input/input_router_impl.h b/content/browser/renderer_host/input/input_router_impl.h
index 39f34ea..1b19697 100644
--- a/content/browser/renderer_host/input/input_router_impl.h
+++ b/content/browser/renderer_host/input/input_router_impl.h
@@ -76,7 +76,8 @@
   void SetFrameTreeNodeId(int frame_tree_node_id) override;
   void SetForceEnableZoom(bool enabled) override;
   cc::TouchAction AllowedTouchAction() override;
-  void BindHost(mojom::WidgetInputHandlerHostRequest request) override;
+  void BindHost(mojom::WidgetInputHandlerHostRequest request,
+                bool frame_handler) override;
 
   // InputHandlerHost impl
   void CancelTouchTimeout() override;
@@ -206,8 +207,14 @@
   // Last touch position relative to screen. Used to compute movementX/Y.
   base::flat_map<int, gfx::Point> global_touch_position_;
 
+  // The host binding associated with the widget input handler from
+  // the widget.
   mojo::Binding<mojom::WidgetInputHandlerHost> host_binding_;
 
+  // The host binding associated with the widget input handler from
+  // the frame.
+  mojo::Binding<mojom::WidgetInputHandlerHost> frame_host_binding_;
+
   base::WeakPtr<InputRouterImpl> weak_this_;
   base::WeakPtrFactory<InputRouterImpl> weak_ptr_factory_;
 
diff --git a/content/browser/renderer_host/input/legacy_input_router_impl.cc b/content/browser/renderer_host/input/legacy_input_router_impl.cc
index ff9d6d9..aac5baa 100644
--- a/content/browser/renderer_host/input/legacy_input_router_impl.cc
+++ b/content/browser/renderer_host/input/legacy_input_router_impl.cc
@@ -203,7 +203,8 @@
 }
 
 void LegacyInputRouterImpl::BindHost(
-    mojom::WidgetInputHandlerHostRequest request) {
+    mojom::WidgetInputHandlerHostRequest request,
+    bool frame_handler) {
   NOTREACHED();
 }
 
diff --git a/content/browser/renderer_host/input/legacy_input_router_impl.h b/content/browser/renderer_host/input/legacy_input_router_impl.h
index 35bc188..be84b53 100644
--- a/content/browser/renderer_host/input/legacy_input_router_impl.h
+++ b/content/browser/renderer_host/input/legacy_input_router_impl.h
@@ -72,7 +72,8 @@
   void NotifySiteIsMobileOptimized(bool is_mobile_optimized) override;
   bool HasPendingEvents() const override;
   void SetDeviceScaleFactor(float device_scale_factor) override;
-  void BindHost(mojom::WidgetInputHandlerHostRequest request) override;
+  void BindHost(mojom::WidgetInputHandlerHostRequest request,
+                bool frame_handler) override;
 
   // IPC::Listener
   bool OnMessageReceived(const IPC::Message& message) override;
diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
index 45b6067..b9acdb8 100644
--- a/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/content/browser/renderer_host/render_widget_host_impl.cc
@@ -2848,8 +2848,12 @@
 }
 
 void RenderWidgetHostImpl::SetWidgetInputHandler(
-    mojom::WidgetInputHandlerAssociatedPtr widget_input_handler) {
-  associated_widget_input_handler_ = std::move(widget_input_handler);
+    mojom::WidgetInputHandlerAssociatedPtr widget_input_handler,
+    mojom::WidgetInputHandlerHostRequest host_request) {
+  if (base::FeatureList::IsEnabled(features::kMojoInputMessages)) {
+    associated_widget_input_handler_ = std::move(widget_input_handler);
+    input_router_->BindHost(std::move(host_request), true);
+  }
 }
 
 void RenderWidgetHostImpl::SetWidget(mojom::WidgetPtr widget) {
@@ -2861,7 +2865,7 @@
         mojo::MakeRequest(&host);
     widget->SetupWidgetInputHandler(mojo::MakeRequest(&widget_input_handler_),
                                     std::move(host));
-    input_router_->BindHost(std::move(host_request));
+    input_router_->BindHost(std::move(host_request), false);
   }
 }
 
diff --git a/content/browser/renderer_host/render_widget_host_impl.h b/content/browser/renderer_host/render_widget_host_impl.h
index ad8dcae..8e29881 100644
--- a/content/browser/renderer_host/render_widget_host_impl.h
+++ b/content/browser/renderer_host/render_widget_host_impl.h
@@ -616,7 +616,8 @@
   // interface calls processed on the FrameInputHandler to be processed in order
   // with the interface calls processed on the WidgetInputHandler.
   void SetWidgetInputHandler(
-      mojom::WidgetInputHandlerAssociatedPtr widget_input_handler);
+      mojom::WidgetInputHandlerAssociatedPtr widget_input_handler,
+      mojom::WidgetInputHandlerHostRequest host_request);
   void SetWidget(mojom::WidgetPtr widget);
 
   // InputRouterImplClient overrides.
diff --git a/content/browser/renderer_host/render_widget_host_unittest.cc b/content/browser/renderer_host/render_widget_host_unittest.cc
index 035664f..befb76f 100644
--- a/content/browser/renderer_host/render_widget_host_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_unittest.cc
@@ -120,7 +120,8 @@
   void SetFrameTreeNodeId(int frameTreeNodeId) override {}
   cc::TouchAction AllowedTouchAction() override { return cc::kTouchActionAuto; }
   void SetForceEnableZoom(bool enabled) override {}
-  void BindHost(mojom::WidgetInputHandlerHostRequest request) override {}
+  void BindHost(mojom::WidgetInputHandlerHostRequest request,
+                bool frame_handler) override {}
 
   // IPC::Listener
   bool OnMessageReceived(const IPC::Message& message) override {
diff --git a/content/common/input/input_handler.mojom b/content/common/input/input_handler.mojom
index 45f7aaee..26209b1 100644
--- a/content/common/input/input_handler.mojom
+++ b/content/common/input/input_handler.mojom
@@ -332,5 +332,6 @@
   // Return an associated WidgetInputHandler interface so that input
   // messages to the widget associated with this frame can be sent
   // serially.
-  GetWidgetInputHandler(associated WidgetInputHandler& interface_request);
+  GetWidgetInputHandler(associated WidgetInputHandler& interface_request,
+                        WidgetInputHandlerHost host);
 };
diff --git a/content/renderer/input/frame_input_handler_impl.cc b/content/renderer/input/frame_input_handler_impl.cc
index ded9a24..7b77bc1 100644
--- a/content/renderer/input/frame_input_handler_impl.cc
+++ b/content/renderer/input/frame_input_handler_impl.cc
@@ -377,18 +377,20 @@
 }
 
 void FrameInputHandlerImpl::GetWidgetInputHandler(
-    mojom::WidgetInputHandlerAssociatedRequest interface_request) {
+    mojom::WidgetInputHandlerAssociatedRequest interface_request,
+    mojom::WidgetInputHandlerHostPtr host) {
   if (!main_thread_task_runner_->BelongsToCurrentThread()) {
     main_thread_task_runner_->PostTask(
         FROM_HERE, base::BindOnce(&FrameInputHandlerImpl::GetWidgetInputHandler,
-                                  weak_this_, std::move(interface_request)));
+                                  weak_this_, std::move(interface_request),
+                                  std::move(host)));
     return;
   }
   if (!render_frame_)
     return;
   render_frame_->GetRenderWidget()
       ->widget_input_handler_manager()
-      ->AddAssociatedInterface(std::move(interface_request));
+      ->AddAssociatedInterface(std::move(interface_request), std::move(host));
 }
 
 void FrameInputHandlerImpl::ExecuteCommandOnMainThread(
diff --git a/content/renderer/input/frame_input_handler_impl.h b/content/renderer/input/frame_input_handler_impl.h
index cf0e9e6..be452f9 100644
--- a/content/renderer/input/frame_input_handler_impl.h
+++ b/content/renderer/input/frame_input_handler_impl.h
@@ -73,7 +73,8 @@
   void ScrollFocusedEditableNodeIntoRect(const gfx::Rect& rect) override;
   void MoveCaret(const gfx::Point& point) override;
   void GetWidgetInputHandler(
-      mojom::WidgetInputHandlerAssociatedRequest interface_request) override;
+      mojom::WidgetInputHandlerAssociatedRequest interface_request,
+      mojom::WidgetInputHandlerHostPtr host) override;
 
  private:
   ~FrameInputHandlerImpl() override;
diff --git a/content/renderer/input/widget_input_handler_manager.cc b/content/renderer/input/widget_input_handler_manager.cc
index 1a214b72..abea4623 100644
--- a/content/renderer/input/widget_input_handler_manager.cc
+++ b/content/renderer/input/widget_input_handler_manager.cc
@@ -76,38 +76,39 @@
 WidgetInputHandlerManager::~WidgetInputHandlerManager() {}
 
 void WidgetInputHandlerManager::AddAssociatedInterface(
-    mojom::WidgetInputHandlerAssociatedRequest request) {
+    mojom::WidgetInputHandlerAssociatedRequest request,
+    mojom::WidgetInputHandlerHostPtr host) {
   if (compositor_task_runner_) {
+    associated_host_ =
+        mojo::ThreadSafeInterfacePtr<mojom::WidgetInputHandlerHost>::Create(
+            host.PassInterface(), compositor_task_runner_);
     // Mojo channel bound on compositor thread.
     compositor_task_runner_->PostTask(
         FROM_HERE,
         base::BindOnce(&WidgetInputHandlerManager::BindAssociatedChannel, this,
                        std::move(request)));
   } else {
+    associated_host_ =
+        mojo::ThreadSafeInterfacePtr<mojom::WidgetInputHandlerHost>::Create(
+            std::move(host));
     // Mojo channel bound on main thread.
     BindAssociatedChannel(std::move(request));
   }
 }
 
-void WidgetInputHandlerManager::SetWidgetInputHandlerHost(
+void WidgetInputHandlerManager::AddInterface(
+    mojom::WidgetInputHandlerRequest request,
     mojom::WidgetInputHandlerHostPtr host) {
   if (compositor_task_runner_) {
     host_ = mojo::ThreadSafeInterfacePtr<mojom::WidgetInputHandlerHost>::Create(
         host.PassInterface(), compositor_task_runner_);
-  } else {
-    host_ = mojo::ThreadSafeInterfacePtr<mojom::WidgetInputHandlerHost>::Create(
-        std::move(host));
-  }
-}
-
-void WidgetInputHandlerManager::AddInterface(
-    mojom::WidgetInputHandlerRequest request) {
-  if (compositor_task_runner_) {
     // Mojo channel bound on compositor thread.
     compositor_task_runner_->PostTask(
         FROM_HERE, base::BindOnce(&WidgetInputHandlerManager::BindChannel, this,
                                   std::move(request)));
   } else {
+    host_ = mojo::ThreadSafeInterfacePtr<mojom::WidgetInputHandlerHost>::Create(
+        std::move(host));
     // Mojo channel bound on main thread.
     BindChannel(std::move(request));
   }
@@ -155,13 +156,11 @@
   params.current_fling_velocity = current_fling_velocity;
   params.causal_event_viewport_point = causal_event_viewport_point;
   params.scroll_boundary_behavior = scroll_boundary_behavior;
-  DCHECK(host_);
-  (*host_)->DidOverscroll(params);
+  GetWidgetInputHandlerHost()->DidOverscroll(params);
 }
 
 void WidgetInputHandlerManager::DidStopFlinging() {
-  DCHECK(host_);
-  (*host_)->DidStopFlinging();
+  GetWidgetInputHandlerHost()->DidStopFlinging();
 }
 
 void WidgetInputHandlerManager::DidAnimateForInput() {
@@ -191,24 +190,24 @@
     uint32_t unique_touch_event_id,
     ui::InputHandlerProxy::EventDisposition event_disposition) {
   InputEventAckState ack_state = InputEventDispositionToAck(event_disposition);
-  DCHECK(host_);
-  (*host_)->SetWhiteListedTouchAction(touch_action, unique_touch_event_id,
-                                      ack_state);
+  GetWidgetInputHandlerHost()->SetWhiteListedTouchAction(
+      touch_action, unique_touch_event_id, ack_state);
 }
 
 void WidgetInputHandlerManager::ProcessTouchAction(
     cc::TouchAction touch_action) {
-  DCHECK(host_);
   // Cancel the touch timeout on TouchActionNone since it is a good hint
   // that author doesn't want scrolling.
   if (touch_action == cc::TouchAction::kTouchActionNone)
-    (*host_)->CancelTouchTimeout();
+    GetWidgetInputHandlerHost()->CancelTouchTimeout();
 }
 
-const WidgetInputHandlerManager::WidgetInputHandlerHost&
+mojom::WidgetInputHandlerHost*
 WidgetInputHandlerManager::GetWidgetInputHandlerHost() {
+  if (associated_host_)
+    return associated_host_.get()->get();
   DCHECK(host_);
-  return host_;
+  return host_.get()->get();
 }
 
 void WidgetInputHandlerManager::ObserveGestureEventOnMainThread(
@@ -278,6 +277,8 @@
 
 void WidgetInputHandlerManager::BindAssociatedChannel(
     mojom::WidgetInputHandlerAssociatedRequest request) {
+  if (!request.is_pending())
+    return;
   WidgetInputHandlerImpl* handler = new WidgetInputHandlerImpl(
       this, main_thread_task_runner_, input_event_queue_, render_widget_);
   handler->SetAssociatedBinding(std::move(request));
@@ -285,6 +286,8 @@
 
 void WidgetInputHandlerManager::BindChannel(
     mojom::WidgetInputHandlerRequest request) {
+  if (!request.is_pending())
+    return;
   WidgetInputHandlerImpl* handler = new WidgetInputHandlerImpl(
       this, main_thread_task_runner_, input_event_queue_, render_widget_);
   handler->SetBinding(std::move(request));
diff --git a/content/renderer/input/widget_input_handler_manager.h b/content/renderer/input/widget_input_handler_manager.h
index 67ed9a6..d082464 100644
--- a/content/renderer/input/widget_input_handler_manager.h
+++ b/content/renderer/input/widget_input_handler_manager.h
@@ -34,10 +34,11 @@
       scoped_refptr<base::SingleThreadTaskRunner> compositor_task_runner,
       blink::scheduler::RendererScheduler* renderer_scheduler);
   void AddAssociatedInterface(
-      mojom::WidgetInputHandlerAssociatedRequest interface_request);
+      mojom::WidgetInputHandlerAssociatedRequest interface_request,
+      mojom::WidgetInputHandlerHostPtr host);
 
-  void SetWidgetInputHandlerHost(mojom::WidgetInputHandlerHostPtr host);
-  void AddInterface(mojom::WidgetInputHandlerRequest interface_request);
+  void AddInterface(mojom::WidgetInputHandlerRequest interface_request,
+                    mojom::WidgetInputHandlerHostPtr host);
 
   // InputHandlerProxyClient overrides.
   void WillShutdown() override;
@@ -75,9 +76,7 @@
 
   void ProcessTouchAction(cc::TouchAction touch_action);
 
-  using WidgetInputHandlerHost = scoped_refptr<
-      mojo::ThreadSafeInterfacePtr<mojom::WidgetInputHandlerHost>>;
-  const WidgetInputHandlerHost& GetWidgetInputHandlerHost();
+  mojom::WidgetInputHandlerHost* GetWidgetInputHandlerHost();
 
  protected:
   friend class base::RefCountedThreadSafe<WidgetInputHandlerManager>;
@@ -123,10 +122,17 @@
   // thread.
   std::unique_ptr<ui::InputHandlerProxy> input_handler_proxy_;
 
+  using WidgetInputHandlerHost = scoped_refptr<
+      mojo::ThreadSafeInterfacePtr<mojom::WidgetInputHandlerHost>>;
+
   // The WidgetInputHandlerHost is bound on the compositor task runner
   // but class can be called on the compositor and main thread.
   WidgetInputHandlerHost host_;
 
+  // Host that was passed as part of the FrameInputHandler associated
+  // channel.
+  WidgetInputHandlerHost associated_host_;
+
   // Any thread can access these variables.
   scoped_refptr<MainThreadEventQueue> input_event_queue_;
   scoped_refptr<base::SingleThreadTaskRunner> main_thread_task_runner_;
diff --git a/content/renderer/render_widget.cc b/content/renderer/render_widget.cc
index 316edef0..5704486f 100644
--- a/content/renderer/render_widget.cc
+++ b/content/renderer/render_widget.cc
@@ -1132,9 +1132,8 @@
 
 void RenderWidget::OnDidOverscroll(const ui::DidOverscrollParams& params) {
   if (widget_input_handler_manager_) {
-    WidgetInputHandlerManager::WidgetInputHandlerHost host =
-        widget_input_handler_manager_->GetWidgetInputHandlerHost();
-    (*host)->DidOverscroll(params);
+    widget_input_handler_manager_->GetWidgetInputHandlerHost()->DidOverscroll(
+        params);
   } else {
     Send(new InputHostMsg_DidOverscroll(routing_id_, params));
   }
@@ -1737,9 +1736,8 @@
     // process to cancel the input method's ongoing composition session, to make
     // sure we are in a consistent state.
     if (widget_input_handler_manager_) {
-      WidgetInputHandlerManager::WidgetInputHandlerHost host =
-          widget_input_handler_manager_->GetWidgetInputHandlerHost();
-      (*host)->ImeCancelComposition();
+      widget_input_handler_manager_->GetWidgetInputHandlerHost()
+          ->ImeCancelComposition();
     } else {
       Send(new InputHostMsg_ImeCancelComposition(routing_id()));
     }
@@ -1992,10 +1990,9 @@
   composition_character_bounds_ = character_bounds;
   composition_range_ = range;
   if (widget_input_handler_manager_) {
-    WidgetInputHandlerManager::WidgetInputHandlerHost host =
-        widget_input_handler_manager_->GetWidgetInputHandlerHost();
-    (*host)->ImeCompositionRangeChanged(composition_range_,
-                                        composition_character_bounds_);
+    widget_input_handler_manager_->GetWidgetInputHandlerHost()
+        ->ImeCompositionRangeChanged(composition_range_,
+                                     composition_character_bounds_);
   } else {
     Send(new InputHostMsg_ImeCompositionRangeChanged(
         routing_id(), composition_range_, composition_character_bounds_));
@@ -2517,8 +2514,8 @@
 void RenderWidget::SetupWidgetInputHandler(
     mojom::WidgetInputHandlerRequest request,
     mojom::WidgetInputHandlerHostPtr host) {
-  widget_input_handler_manager_->AddInterface(std::move(request));
-  widget_input_handler_manager_->SetWidgetInputHandlerHost(std::move(host));
+  widget_input_handler_manager_->AddInterface(std::move(request),
+                                              std::move(host));
 }
 
 void RenderWidget::SetWidgetBinding(mojom::WidgetRequest request) {
diff --git a/content/renderer/render_widget_unittest.cc b/content/renderer/render_widget_unittest.cc
index aea2c27d..3b6c797 100644
--- a/content/renderer/render_widget_unittest.cc
+++ b/content/renderer/render_widget_unittest.cc
@@ -143,8 +143,8 @@
     mock_input_handler_host_ = std::make_unique<MockWidgetInputHandlerHost>(
         mojo::MakeRequest(&widget_input_handler));
 
-    widget_input_handler_manager_->SetWidgetInputHandlerHost(
-        std::move(widget_input_handler));
+    widget_input_handler_manager_->AddInterface(
+        nullptr, std::move(widget_input_handler));
   }
 
   void SetTouchRegion(const std::vector<gfx::Rect>& rects) {