Early-return in RenderViewImpl::DidFlushPaint() if there is no WebView.

content/renderer/render_view_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_view_impl.h"
 
 #include <algorithm>
 #include <cmath>
 #include <string>
 #include <vector>
@@ skipping 4318 matching lines @@
   pepper_delegate_.ViewInitiatedPaint();
 }
 
 void RenderViewImpl::DidFlushPaint() {
   // Notify any pepper plugins that we painted. This will call into the plugin,
   // and we it may ask to close itself as a result. This will, in turn, modify
   // our set, possibly invalidating the iterator. So we iterate on a copy that
   // won't change out from under us.
   pepper_delegate_.ViewFlushedPaint();
 
+  // If the RenderWidget is closing down then early-exit, otherwise we'll crash.
+  // See crbug.com/112921.
+  if (!webview())
+    return;
+
   WebFrame* main_frame = webview()->mainFrame();
 
   // If we have a provisional frame we are between the start and commit stages
   // of loading and we don't want to save stats.
   if (!main_frame->provisionalDataSource()) {
     WebDataSource* ds = main_frame->dataSource();
     DocumentState* document_state = DocumentState::FromDataSource(ds);
 
     // TODO(jar): The following code should all be inside a method, probably in
     // NavigatorState.
@@ skipping 626 matching lines @@
 bool RenderViewImpl::WebWidgetHandlesCompositorScheduling() const {
   return !!RenderThreadImpl::current()->compositor_thread();
 }
 
 void RenderViewImpl::OnJavaBridgeInit() {
   DCHECK(!java_bridge_dispatcher_.get());
 #if defined(ENABLE_JAVA_BRIDGE)
   java_bridge_dispatcher_.reset(new JavaBridgeDispatcher(this));
 #endif
 }