Fix use-after-free in the renderer process.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 7c13c18e19f3cca5553b8681b09ff77650559056..f20c460c984b3f8509d372ea3ae578880d7be9ef 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -2828,6 +2828,11 @@ void RenderFrameImpl::frameDetached(blink::WebLocalFrame* frame,
   // called on the parent frame.
   DCHECK_EQ(frame_, frame);
 
+#if defined(ENABLE_PLUGINS)
+  if (focused_pepper_plugin_)
+    GetRenderWidget()->set_focused_pepper_plugin(nullptr);

[Charlie Reis, 2016/08/24 20:38:44]

Looks like there's a focused_pepper_plugin_ on both RenderFrameImpl and
RenderWidget?

I'm not sure why we would check one and clear the other.  Shouldn't we be
checking and clearing the same one, or keeping them in sync?

+#endif
+
   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, FrameDetached());
   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
                     FrameDetached(frame));