Snapshot a pointer to the main frame when creating WebViewFrameWidget.

Source/web/WebViewFrameWidget.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be found
 // in the LICENSE file.
 
 #include "config.h"
 #include "web/WebViewFrameWidget.h"
 
 #include "web/WebLocalFrameImpl.h"
 #include "web/WebViewImpl.h"
 
 namespace blink {
 
-WebViewFrameWidget::WebViewFrameWidget(WebViewImpl& webView) : m_webView(&webView)
+WebViewFrameWidget::WebViewFrameWidget(WebWidgetClient* client, WebViewImpl& webView, WebLocalFrameImpl& mainFrame)
+    : m_client(client), m_webView(&webView), m_mainFrame(&mainFrame)
 {
-    m_webView->mainFrameImpl()->setFrameWidget(this);
+    m_mainFrame->setFrameWidget(this);
 }
 
 WebViewFrameWidget::~WebViewFrameWidget()
 {
 }
 
 void WebViewFrameWidget::close()
 {
-    m_webView->mainFrameImpl()->setFrameWidget(nullptr);
+    // Note: it's important to use the captured main frame pointer here. During
+    // a frame swap, the swapped frame is detached *after* the frame tree is
+    // updated. If the main frame is being swapped, then
+    // m_webView()->mainFrameImpl() will no longer point to the original frame.
+    m_mainFrame->setFrameWidget(nullptr);
+    m_mainFrame = nullptr;
     m_webView = nullptr;
+    m_client = nullptr;
 
     // Note: this intentionally does not forward to WebView::close(), to make it
     // easier to untangle the cleanup logic later.
 
     delete this;
 }
 
 WebSize WebViewFrameWidget::size()
 {
     return m_webView->size();
@@ skipping 212 matching lines @@
 {
     return m_webView->updateTopControlsState(constraints, current, animate);
 }
 
 void WebViewFrameWidget::setVisibilityState(WebPageVisibilityState visibilityState, bool isInitialState)
 {
     return m_webView->setVisibilityState(visibilityState, isInitialState);
 }
 
 } // namespace blink