Deal with frame removal by content scripts

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index bb2156a285c74eaaef452b2e81c7f5b534d43756..93f2d7816013570c80fcb6c41cd3f7a5076c3301 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -3374,10 +3374,14 @@ void RenderFrameImpl::didCreateDocumentElement(blink::WebLocalFrame* frame) {
     }
   }
 
+  // TODO(robwu): Wrap observers in ScriptForbiddenScope (see crbug.com/582008).
   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
                     DidCreateDocumentElement());
   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
                     DidCreateDocumentElement(frame));
+
+  GetContentClient()->renderer()->AfterDidCreateDocumentElement(this);
+  // Do not use |this| or |frame|! ContentClient might have deleted them by now!
 }
 
 void RenderFrameImpl::didReceiveTitle(blink::WebLocalFrame* frame,
@@ -3417,10 +3421,16 @@ void RenderFrameImpl::didFinishDocumentLoad(blink::WebLocalFrame* frame,
 
   Send(new FrameHostMsg_DidFinishDocumentLoad(routing_id_));
 
+  // TODO(robwu): Wrap observers in ScriptForbiddenScope (see crbug.com/582008).
   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
                     DidFinishDocumentLoad(frame));
   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidFinishDocumentLoad());
 
+  base::WeakPtr<RenderFrame> weak_self = weak_factory_.GetWeakPtr();
+  GetContentClient()->renderer()->AfterDidFinishDocumentLoad(this);
+  if (!weak_self.get())
+    return;
+
   // Check whether we have new encoding name.
   UpdateEncoding(frame, frame->view()->pageEncoding().utf8());