Clear RenderFrameImpl::frame_ pointer after deleting it.

content/renderer/render_frame_impl.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_RENDERER_RENDER_FRAME_IMPL_H_
 #define CONTENT_RENDERER_RENDER_FRAME_IMPL_H_
 
 #include <vector>
 
 #include "base/basictypes.h"
@@ skipping 708 matching lines @@
       media::MediaPermission* media_permission,
       blink::WebContentDecryptionModule* initial_cdm);
 
   RendererMediaPlayerManager* GetMediaPlayerManager();
 #endif
 
 #if defined(ENABLE_BROWSER_CDMS)
   RendererCdmManager* GetCdmManager();
 #endif
 
-  // Stores the WebLocalFrame we are associated with.
+  // Stores the WebLocalFrame we are associated with.  This is null from the
+  // constructor until SetWebFrame is called, and it is null after
+  // frameDetached is called until destruction (which is asynchronous in the
+  // case of the main frame, but not subframes).
   blink::WebLocalFrame* frame_;
 
   base::WeakPtr<RenderViewImpl> render_view_;
   int routing_id_;
   bool is_swapped_out_;
   // RenderFrameProxy exists only when is_swapped_out_ is true.
   // TODO(nasko): This can be removed once we don't have a swapped out state on
   // RenderFrame. See https://crbug.com/357747.
   RenderFrameProxy* render_frame_proxy_;
   bool is_detaching_;
@@ skipping 129 matching lines @@
 #endif
 
   base::WeakPtrFactory<RenderFrameImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderFrameImpl);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_RENDERER_RENDER_FRAME_IMPL_H_