Deal with frame removal by content scripts

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index bb2156a285c74eaaef452b2e81c7f5b534d43756..32863148b84b6a173421894cb217d4bd07879d17 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -3378,6 +3378,9 @@ void RenderFrameImpl::didCreateDocumentElement(blink::WebLocalFrame* frame) {
                     DidCreateDocumentElement());
   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
                     DidCreateDocumentElement(frame));
+
+  GetContentClient()->renderer()->AfterDidCreateDocumentElement(this);
+  // Do not use |this| or |frame|! ContentClient might have deleted them by now!
 }
 
 void RenderFrameImpl::didReceiveTitle(blink::WebLocalFrame* frame,
@@ -3421,6 +3424,11 @@ void RenderFrameImpl::didFinishDocumentLoad(blink::WebLocalFrame* frame,
                     DidFinishDocumentLoad(frame));
   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidFinishDocumentLoad());
 
+  base::WeakPtr<RenderFrame> weak_self = weak_factory_.GetWeakPtr();
+  GetContentClient()->renderer()->AfterDidFinishDocumentLoad(this);
+  if (!weak_self.get())
+    return;
+
   // Check whether we have new encoding name.
   UpdateEncoding(frame, frame->view()->pageEncoding().utf8());