Fix file chooser on ChromeOS.

Fix file chooser on ChromeOS.

A previous CL - https://codereview.chromium.org/2102883002/, introduced
a bug specific to the ChromeOS version of the file chooser. It fixed a
use-after-free bug by monitoring for RenderFrame deletions. However,
on ChromeOS, the file picker is itself a RenderFrame and the code didn't
account for nullifying the cached object only when they match.
This CL fixes the issue by ensuring that the pointer is cleared only
when the object being deleted matches.

BUG=624956
Review-Url: https://codereview.chromium.org/2113353002
Cr-Commit-Position: refs/heads/master@{#403554}
(cherry picked from commit 5e61b75ffa3c2fe805124b5969e8dff578510b99)

Committed: https://chromium.googlesource.com/chromium/src/+/c9bd48036f5e78fdc8aee791d455256532d30c5b

[Charlie Reis, 2016-07-06 16:36:35]

creis@chromium.org changed reviewers:
+ nasko@chromium.org

[Charlie Reis, 2016-07-06 16:36:35]

Merging to M53.

[Charlie Reis, 2016-07-06 16:40:31]

Description was changed from

==========
Fix file chooser on ChromeOS.

A previous CL - https://codereview.chromium.org/2102883002/, introduced
a bug specific to the ChromeOS version of the file chooser. It fixed a
use-after-free bug by monitoring for RenderFrame deletions. However,
on ChromeOS, the file picker is itself a RenderFrame and the code didn't
account for nullifying the cached object only when they match.
This CL fixes the issue by ensuring that the pointer is cleared only
when the object being deleted matches.

BUG=624956

Review-Url: https://codereview.chromium.org/2113353002
Cr-Commit-Position: refs/heads/master@{#403554}
(cherry picked from commit 5e61b75ffa3c2fe805124b5969e8dff578510b99)
==========

to

==========
Fix file chooser on ChromeOS.

A previous CL - https://codereview.chromium.org/2102883002/, introduced
a bug specific to the ChromeOS version of the file chooser. It fixed a
use-after-free bug by monitoring for RenderFrame deletions. However,
on ChromeOS, the file picker is itself a RenderFrame and the code didn't
account for nullifying the cached object only when they match.
This CL fixes the issue by ensuring that the pointer is cleared only
when the object being deleted matches.

BUG=624956

Review-Url: https://codereview.chromium.org/2113353002
Cr-Commit-Position: refs/heads/master@{#403554}
(cherry picked from commit 5e61b75ffa3c2fe805124b5969e8dff578510b99)

Committed:
https://chromium.googlesource.com/chromium/src/+/c9bd48036f5e78fdc8aee791d455...
==========

[Charlie Reis, 2016-07-06 16:40:32]

Committed patchset #1 (id:1) manually as
c9bd48036f5e78fdc8aee791d455256532d30c5b.