Index: content/renderer/render_frame_impl.cc |
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc |
index dcda81760d95e21d23b6212ab24b993692b94d96..66912c09b9801a3ad575a3fba8ae8480cf709fbf 100644 |
--- a/content/renderer/render_frame_impl.cc |
+++ b/content/renderer/render_frame_impl.cc |
@@ -905,6 +905,11 @@ void RenderFrameImpl::DidHideExternalPopupMenu() { |
#endif |
bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) { |
+ // We may get here while detaching, when the WebFrame has been deleted. Do |
+ // not process any messages in this state. |
+ if (!frame_) |
+ return false; |
+ |
// TODO(kenrb): document() should not be null, but as a transitional step |
// we have RenderFrameProxy 'wrapping' a RenderFrameImpl, passing messages |
// to this method. This happens for a top-level remote frame, where a |
@@ -2048,8 +2053,11 @@ void RenderFrameImpl::frameDetached(blink::WebFrame* frame) { |
if (is_subframe) |
frame->parent()->removeChild(frame); |
- // |frame| is invalid after here. |
+ // |frame| is invalid after here. Be sure to clear frame_ as well, since this |
+ // object may not be deleted immediately and other methods may try to access |
+ // it. |
frame->close(); |
+ frame_ = nullptr; |
if (is_subframe) { |
delete this; |