Fix flaky crash in WebPagePopupImpl::closePopup.

Source/web/WebViewImpl.cpp

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 1628 matching lines @@
         m_pagePopup = nullptr;
     }
     enablePopupMouseWheelEventListener();
     return m_pagePopup.get();
 }
 
 void WebViewImpl::closePagePopup(PagePopup* popup)
 {
     ASSERT(popup);
     WebPagePopupImpl* popupImpl = toWebPagePopupImpl(popup);
-    ASSERT(m_pagePopup.get() == popupImpl);
-    if (m_pagePopup.get() != popupImpl)
+    // It's possible that closePagePopup is called from pagePopup->closePopup()
+    // below because the main frame of the page popup can have the last
+    // reference to the pagePopupOwner Element. So, we clear m_pagePopup before
+    // pagePopup->closePopup(), and do nothing if m_pagepopup is nullptr.
+    ASSERT(!m_pagePopup || m_pagePopup.get() == popupImpl);
+    if (!m_pagePopup || m_pagePopup.get() != popupImpl)
         return;
-    m_pagePopup->closePopup();
-    m_pagePopup = nullptr;
+    RefPtr<WebPagePopupImpl> pagePopup = m_pagePopup.release();
+    pagePopup->closePopup();
     disablePopupMouseWheelEventListener();
 }
 
 void WebViewImpl::cancelPagePopup()
 {
     if (m_pagePopup)
         m_pagePopup->cancel();
 }
 
 void WebViewImpl::enablePopupMouseWheelEventListener()
@@ skipping 2837 matching lines @@
     if (m_pageColorOverlay)
         m_pageColorOverlay->update();
     if (m_inspectorOverlay) {
         PageOverlay* inspectorPageOverlay = m_inspectorOverlay->pageOverlay();
         if (inspectorPageOverlay)
             inspectorPageOverlay->update();
     }
 }
 
 } // namespace blink