Fix use-after-free when navigating a subframe to about:blank.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 5483 matching lines @@
     if (!common_params.base_url_for_data_url.is_empty() ||
 #if defined(OS_ANDROID)
         !request_params.data_url_as_string.empty() ||
 #endif
         (browser_side_navigation &&
          common_params.url.SchemeIs(url::kDataScheme))) {
       LoadDataURL(common_params, request_params, frame_, load_type,
                   item_for_history_navigation, history_load_type,
                   is_client_redirect);
     } else {
+      // The load of the URL can result in this frame being removed. Use a
+      // WeakPtr as an easy way to detect whether this has occured. If so, this
+      // method should return immediately and not touch any part of the object,
+      // otherwise it will result in a use-after-free bug.
+      base::WeakPtr<RenderFrameImpl> weak_this = weak_factory_.GetWeakPtr();
+
       // Load the request.
       frame_->load(request, load_type, item_for_history_navigation,
                    history_load_type, is_client_redirect);
+
+      if (!weak_this.get())

[dcheng, 2016/03/03 00:46:59]

No .get()

[nasko, 2016/03/03 16:59:17]

Done.

+        return;
     }
   } else {
     // The browser expects the frame to be loading this navigation. Inform it
     // that the load stopped if needed.
     // Note: in the case of history navigations, |should_load_request| will be
     // false, and the frame may not have been set in a loading state. Do not
     // send a stop message if the HistoryController is loading in this frame
     // nonetheless. This behavior will go away with subframe navigation
     // entries.
     if (!frame_->isLoading() && !has_history_navigation_in_frame)
@@ skipping 585 matching lines @@
                                     int match_count,
                                     int ordinal,
                                     const WebRect& selection_rect,
                                     bool final_status_update) {
   Send(new FrameHostMsg_Find_Reply(routing_id_, request_id, match_count,
                                    selection_rect, ordinal,
                                    final_status_update));
 }
 
 }  // namespace content