Fix renderer crashes when frame gets detached while injectng user scripts.

chrome/renderer/extensions/dispatcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/dispatcher.h"
 
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/debug/alias.h"
 #include "base/json/json_reader.h"
@@ skipping 1272 matching lines @@
   if (!v8_context->HasOutOfMemoryException())
     context->DispatchOnUnloadEvent();
   // TODO(kalman): add an invalidation observer interface to ChromeV8Context.
   request_sender_->InvalidateSource(context);
 
   v8_context_set_.Remove(context);
   VLOG(1) << "Num tracked contexts: " << v8_context_set_.size();
 }
 
 void Dispatcher::DidCreateDocumentElement(blink::WebFrame* frame) {
+  if (frame->document().isNull())
+    return;
+
   if (IsWithinPlatformApp()) {
     // WebKit doesn't let us define an additional user agent stylesheet, so we
     // insert the default platform app stylesheet into all documents that are
     // loaded in each app.
     std::string stylesheet =
         ResourceBundle::GetSharedInstance().
             GetRawDataResource(IDR_PLATFORM_APP_CSS).as_string();
     ReplaceFirstSubstringAfterOffset(&stylesheet, 0,
                                      "$FONTFAMILY", system_font_family_);
     ReplaceFirstSubstringAfterOffset(&stylesheet, 0,
@@ skipping 381 matching lines @@
 }
 
 void Dispatcher::ClearPortData(int port_id) {
   // Only the target port side has entries in |port_to_tab_id_map_|. If
   // |port_id| is a source port, std::map::erase() will just silently fail
   // here as a no-op.
   port_to_tab_id_map_.erase(port_id);
 }
 
 }  // namespace extensions