Do not dereference potentially invalid frame pointer.

chrome/renderer/extensions/bindings_utils.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_RENDERER_EXTENSIONS_BINDINGS_UTILS_H_
 #define CHROME_RENDERER_EXTENSIONS_BINDINGS_UTILS_H_
 #pragma once
 
 #include "base/memory/linked_ptr.h"
 #include "base/memory/singleton.h"
@@ skipping 73 matching lines @@
   ContextInfo(v8::Persistent<v8::Context> context,
               const std::string& extension_id,
               WebKit::WebFrame* frame);
   ~ContextInfo();
 
   v8::Persistent<v8::Context> context;
 
   // The extension ID this context is associated with.
   std::string extension_id;
 
-  // The frame the context is associated with. We can't always get this from
-  // WebFrame::frameForContext() (in particular as the the frame is navigating
-  // or being destroyed).
-  WebKit::WebFrame* frame;
+  // The frame the context is associated with. ContextInfo can outlive its
+  // frame, so this should not be dereferenced. It is stored only for use for
+  // comparison.
+  void* unsafe_frame;
 
   // A count of the number of events that are listening in this context. When
   // this is zero, |context| will be a weak handle.
   int num_connected_events;
 };
 typedef std::list< linked_ptr<ContextInfo> > ContextList;
 
 // Returns a mutable reference to the ContextList. Note: be careful using this.
 // Calling into javascript may result in the list being modified, so don't rely
 // on iterators remaining valid between calls to javascript.
@@ skipping 28 matching lines @@
 // be a sub-property like "Port.dispatchOnMessage". Returns the result of
 // the function call. If an exception is thrown an empty Handle will be
 // returned.
 v8::Handle<v8::Value> CallFunctionInContext(v8::Handle<v8::Context> context,
     const std::string& function_name, int argc,
     v8::Handle<v8::Value>* argv);
 
 }  // namespace bindings_utils
 
 #endif  // CHROME_RENDERER_EXTENSIONS_BINDINGS_UTILS_H_