Delete entry in WebFrame->RenderFrameProxy map at WebFrame::close time.

content/renderer/render_frame_proxy.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_proxy.h"
 
 #include <map>
 
 #include "base/lazy_instance.h"
 #include "content/child/webmessageportchannel_impl.h"
@@ skipping 113 matching lines @@
   // when detaching the main frame. This can be removed once RenderFrameImpl and
   // RenderFrameProxy have been completely decoupled. See
   // https://crbug.com/357747.
   RenderFrameImpl* render_frame =
       RenderFrameImpl::FromRoutingID(frame_routing_id_);
   if (render_frame)
     render_frame->set_render_frame_proxy(nullptr);
 
   render_view()->UnregisterRenderFrameProxy(this);
 
-  FrameMap::iterator it = g_frame_map.Get().find(web_frame_);
-  CHECK(it != g_frame_map.Get().end());
-  CHECK_EQ(it->second, this);
-  g_frame_map.Get().erase(it);
-
+  CHECK(!web_frame_);
   RenderThread::Get()->RemoveRoute(routing_id_);
   g_routing_id_proxy_map.Get().erase(routing_id_);
 }
 
 void RenderFrameProxy::Init(blink::WebRemoteFrame* web_frame,
                             RenderViewImpl* render_view) {
   CHECK(web_frame);
   CHECK(render_view);
 
   web_frame_ = web_frame;
@@ skipping 163 matching lines @@
 void RenderFrameProxy::frameDetached() {
   if (web_frame_->parent()) {
     web_frame_->parent()->removeChild(web_frame_);
 
     // Let the browser process know this subframe is removed, so that it is
     // destroyed in its current process.
     Send(new FrameHostMsg_Detach(routing_id_));
   }
 
   web_frame_->close();
+
+  // Remove the entry in the WebFrame->RenderFrameProxy map, as the |web_frame_|
+  // is no longer valid.
+  FrameMap::iterator it = g_frame_map.Get().find(web_frame_);
+  CHECK(it != g_frame_map.Get().end());
+  CHECK_EQ(it->second, this);
+  g_frame_map.Get().erase(it);
+
+  web_frame_ = nullptr;
+
   delete this;
 }
 
 void RenderFrameProxy::postMessageEvent(
     blink::WebLocalFrame* source_frame,
     blink::WebRemoteFrame* target_frame,
     blink::WebSecurityOrigin target_origin,
     blink::WebDOMMessageEvent event) {
   DCHECK(!web_frame_ || web_frame_ == target_frame);
 
@@ skipping 42 matching lines @@
       blink::WebUserGestureIndicator::isProcessingUserGesture();
   blink::WebUserGestureIndicator::consumeUserGesture();
   Send(new FrameHostMsg_OpenURL(routing_id_, params));
 }
 
 void RenderFrameProxy::forwardInputEvent(const blink::WebInputEvent* event) {
   Send(new FrameHostMsg_ForwardInputEvent(routing_id_, event));
 }
 
 }  // namespace