Deal with frame removal by content scripts

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 3356 matching lines @@
     if (frame == main_frame) {
       // For now, don't remember plugin zoom values.  We don't want to mix them
       // with normal web content (i.e. a fixed layout plugin would usually want
       // them different).
       render_view_->Send(new ViewHostMsg_DocumentAvailableInMainFrame(
           render_view_->GetRoutingID(),
           main_frame->document().isPluginDocument()));
     }
   }
 
+  // TODO(robwu): Wrap observers in ScriptForbiddenScope (see crbug.com/582008).
   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
                     DidCreateDocumentElement());
   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
                     DidCreateDocumentElement(frame));
+
+  GetContentClient()->renderer()->AfterDidCreateDocumentElement(this);
+  // Do not use |this| or |frame|! ContentClient might have deleted them by now!
 }
 
 void RenderFrameImpl::didReceiveTitle(blink::WebLocalFrame* frame,
                                       const blink::WebString& title,
                                       blink::WebTextDirection direction) {
   DCHECK(!frame_ || frame_ == frame);
   // Ignore all but top level navigations.
   if (!frame->parent()) {
     base::string16 title16 = title;
     base::trace_event::TraceLog::GetInstance()->UpdateProcessLabel(
@@ skipping 19 matching lines @@
                                             bool document_is_empty) {
   TRACE_EVENT1("navigation,benchmark", "RenderFrameImpl::didFinishDocumentLoad",
                "id", routing_id_);
   DCHECK(!frame_ || frame_ == frame);
   WebDataSource* ds = frame->dataSource();
   DocumentState* document_state = DocumentState::FromDataSource(ds);
   document_state->set_finish_document_load_time(Time::Now());
 
   Send(new FrameHostMsg_DidFinishDocumentLoad(routing_id_));
 
+  // TODO(robwu): Wrap observers in ScriptForbiddenScope (see crbug.com/582008).
   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
                     DidFinishDocumentLoad(frame));
   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidFinishDocumentLoad());
 
+  base::WeakPtr<RenderFrame> weak_self = weak_factory_.GetWeakPtr();
+  GetContentClient()->renderer()->AfterDidFinishDocumentLoad(this);
+  if (!weak_self.get())
+    return;
+
   // Check whether we have new encoding name.
   UpdateEncoding(frame, frame->view()->pageEncoding().utf8());
 
   // If this is an empty document with an http status code indicating an error,
   // we may want to display our own error page, so the user doesn't end up
   // with an unexplained blank page.
   if (!document_is_empty)
     return;
 
   // Do not show error page when DevTools is attached.
@@ skipping 2697 matching lines @@
                                     int match_count,
                                     int ordinal,
                                     const WebRect& selection_rect,
                                     bool final_status_update) {
   Send(new FrameHostMsg_Find_Reply(routing_id_, request_id, match_count,
                                    selection_rect, ordinal,
                                    final_status_update));
 }
 
 }  // namespace content