Deal with frame removal by content scripts

extensions/renderer/dispatcher.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef EXTENSIONS_RENDERER_DISPATCHER_H_
 #define EXTENSIONS_RENDERER_DISPATCHER_H_
 
 #include <stdint.h>
 
 #include <map>
@@ skipping 90 matching lines @@
 
   void WillReleaseScriptContext(blink::WebLocalFrame* frame,
                                 const v8::Local<v8::Context>& context,
                                 int world_id);
 
   // Runs on a different thread and should not use any member variables.
   static void WillDestroyServiceWorkerContextOnWorkerThread(
       v8::Local<v8::Context> v8_context,
       const GURL& url);
 
+  // This method is not allowed to run JavaScript code in the frame.
   void DidCreateDocumentElement(blink::WebLocalFrame* frame);
 
+  // These methods may run (untrusted) JavaScript code in the frame, and
+  // cause |render_frame| to become invalid.
+  void RunScriptsAtDocumentStart(content::RenderFrame* render_frame);
+  void RunScriptsAtDocumentEnd(content::RenderFrame* render_frame);
+
   void OnExtensionResponse(int request_id,
                            bool success,
                            const base::ListValue& response,
                            const std::string& error);
 
   // Dispatches the event named |event_name| to all render views.
   void DispatchEvent(const std::string& extension_id,
                      const std::string& event_name) const;
 
   // Shared implementation of the various MessageInvoke IPCs.
@@ skipping 184 matching lines @@
   // if this renderer is a WebView guest render process. Otherwise, this will be
   // empty.
   std::string webview_partition_id_;
 
   DISALLOW_COPY_AND_ASSIGN(Dispatcher);
 };
 
 }  // namespace extensions
 
 #endif  // EXTENSIONS_RENDERER_DISPATCHER_H_