Destroy (Password)AutofillAgent safely

components/autofill/content/renderer/form_autofill_util.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/autofill/content/renderer/form_autofill_util.h"
 
 #include <map>
 #include <set>
 
 #include "base/command_line.h"
@@ skipping 875 matching lines @@
     input_element->setChecked(data.is_checked, true);
   } else {
     base::string16 value = data.value;
     if (IsTextInput(input_element) || IsMonthInput(input_element)) {
       // If the maxlength attribute contains a negative value, maxLength()
       // returns the default maxlength value.
       TruncateString(&value, input_element->maxLength());
     }
     field->setValue(value, true);
   }
+  // Setting the form might trigger JavaScript, which is capable of
+  // destroying the frame.
+  if (!field->document().frame())
+    return;
 
   field->setAutofilled(true);
 
   if (is_initiating_node &&
       ((IsTextInput(input_element) || IsMonthInput(input_element)) ||
        IsTextAreaElement(*field))) {
     int length = field->value().length();
     field->setSelectionRange(length, length);
     // Clear the current IME composition (the underline), if there is one.
     field->document().frame()->unmarkText();
@@ skipping 857 matching lines @@
     // Zero selection start is for password manager, which can show usernames
     // that do not begin with the user input value.
     selection_start = (offset == base::string16::npos) ? 0 : offset;
   }
 
   input_element->setSelectionRange(selection_start, suggestion.length());
 }
 
 }  // namespace form_util
 }  // namespace autofill