Do not dereference potentially invalid frame pointer.

chrome/renderer/extensions/bindings_utils.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_RENDERER_EXTENSIONS_BINDINGS_UTILS_H_
 #define CHROME_RENDERER_EXTENSIONS_BINDINGS_UTILS_H_
 #pragma once
 
 #include "base/memory/linked_ptr.h"
 #include "base/memory/singleton.h"
@@ skipping 64 matching lines @@
   // Helper to print from bindings javascript.
   static v8::Handle<v8::Value> Print(const v8::Arguments& args);
 };
 
 const char* GetStringResource(int resource_id);
 
 // Contains information about a JavaScript context that is hosting extension
 // bindings.
 struct ContextInfo {
   ContextInfo(v8::Persistent<v8::Context> context,
-              const std::string& extension_id,
-              WebKit::WebFrame* frame);
+              v8::Persistent<v8::Context> main_world_context,
+              const std::string& extension_id);
   ~ContextInfo();
 
+  // The context hosting the bindings. If this is a content script, the handle
+  // will be weak.
   v8::Persistent<v8::Context> context;
 
+  // If the context is a content script, this contains a reference to the
+  // corresponding main world's context. It is weak, but it should always be
+  // valid because we delete ContextInfo for content scripts when the
+  // corresponding main world context is destroyed.
+  v8::Persistent<v8::Context> main_world_context;
+
   // The extension ID this context is associated with.
   std::string extension_id;
 
-  // The frame the context is associated with. We can't always get this from
-  // WebFrame::frameForContext() (in particular as the the frame is navigating
-  // or being destroyed).
-  WebKit::WebFrame* frame;
-
   // A count of the number of events that are listening in this context. When
   // this is zero, |context| will be a weak handle.
   int num_connected_events;
 };
 typedef std::list< linked_ptr<ContextInfo> > ContextList;
 
 // Returns a mutable reference to the ContextList. Note: be careful using this.
 // Calling into javascript may result in the list being modified, so don't rely
 // on iterators remaining valid between calls to javascript.
 ContextList& GetContexts();
@@ skipping 27 matching lines @@
 // be a sub-property like "Port.dispatchOnMessage". Returns the result of
 // the function call. If an exception is thrown an empty Handle will be
 // returned.
 v8::Handle<v8::Value> CallFunctionInContext(v8::Handle<v8::Context> context,
     const std::string& function_name, int argc,
     v8::Handle<v8::Value>* argv);
 
 }  // namespace bindings_utils
 
 #endif  // CHROME_RENDERER_EXTENSIONS_BINDINGS_UTILS_H_