[Extensions] Handle some funny cases in script injection

extensions/renderer/programmatic_script_injector.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/programmatic_script_injector.h"
 
 #include <vector>
 
 #include "base/values.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/renderer/render_frame.h"
+#include "content/public/renderer/render_frame_observer.h"
 #include "extensions/common/error_utils.h"
 #include "extensions/common/extension_messages.h"
 #include "extensions/common/manifest_constants.h"
 #include "extensions/common/permissions/permissions_data.h"
 #include "extensions/renderer/injection_host.h"
 #include "extensions/renderer/script_context.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/web/WebDocument.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 #include "third_party/WebKit/public/web/WebScriptSource.h"
 
 namespace extensions {
 
+// Watches for the deletion of a RenderFrame, after which is_valid will return
+// false.
+class ProgrammaticScriptInjector::FrameWatcher
+    : public content::RenderFrameObserver {
+ public:
+  explicit FrameWatcher(content::RenderFrame* render_frame)
+      : content::RenderFrameObserver(render_frame), is_valid_(true) {}
+  ~FrameWatcher() override {}
+
+  bool is_frame_valid() const { return is_valid_; }
+
+ private:
+  void FrameDetached() override { is_valid_ = false; }
+  void OnDestruct() override { is_valid_ = false; }
+
+  bool is_valid_;
+
+  DISALLOW_COPY_AND_ASSIGN(FrameWatcher);
+};
+
 ProgrammaticScriptInjector::ProgrammaticScriptInjector(
     const ExtensionMsg_ExecuteCode_Params& params,
     content::RenderFrame* render_frame)
     : params_(new ExtensionMsg_ExecuteCode_Params(params)),
-      url_(ScriptContext::GetDataSourceURLForFrame(
-          render_frame->GetWebFrame())),
-      render_frame_(render_frame),
+      url_(
+          ScriptContext::GetDataSourceURLForFrame(render_frame->GetWebFrame())),
+      frame_watcher_(new FrameWatcher(render_frame)),
       finished_(false) {
   effective_url_ = ScriptContext::GetEffectiveDocumentURL(
       render_frame->GetWebFrame(), url_, params.match_about_blank);
 }
 
 ProgrammaticScriptInjector::~ProgrammaticScriptInjector() {
 }
 
 UserScript::InjectionType ProgrammaticScriptInjector::script_type()
     const {
@@ skipping 101 matching lines @@
 }
 
 UserScript::RunLocation ProgrammaticScriptInjector::GetRunLocation() const {
   return static_cast<UserScript::RunLocation>(params_->run_at);
 }
 
 void ProgrammaticScriptInjector::Finish(const std::string& error) {
   DCHECK(!finished_);
   finished_ = true;
 
-  render_frame_->Send(new ExtensionHostMsg_ExecuteCodeFinished(
-      render_frame_->GetRoutingID(),
-      params_->request_id,
-      error,
-      url_,
-      results_));
+  // It's possible that the render frame was destroyed in the course of
+  // injecting scripts. Don't respond if it was (the browser side watches for
+  // frame deletions so nothing is left hanging).
+  if (frame_watcher_->is_frame_valid()) {
+    frame_watcher_->render_frame()->Send(
+        new ExtensionHostMsg_ExecuteCodeFinished(
+            frame_watcher_->render_frame()->GetRoutingID(), params_->request_id,
+            error, url_, results_));
+  }
 }
 
 }  // namespace extensions