Avoid use-after-free if frame is deleted when stopping loading.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 4455 matching lines @@
   observers_.AddObserver(observer);
 }
 
 void RenderFrameImpl::RemoveObserver(RenderFrameObserver* observer) {
   observer->RenderFrameGone();
   observers_.RemoveObserver(observer);
 }
 
 void RenderFrameImpl::OnStop() {
   DCHECK(frame_);
+
+  // The stopLoading call may run script, which may cause this frame to be
+  // detached/deleted.  If that happens, return immediately.
+  base::WeakPtr<RenderFrameImpl> weak_this = weak_factory_.GetWeakPtr();
   frame_->stopLoading();
+  if (!weak_this)
+    return;
+
   if (frame_ && !frame_->parent())
     FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers_, OnStop());
 
   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, OnStop());
 }
 
 void RenderFrameImpl::WasHidden() {
   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, WasHidden());
 
 #if defined(ENABLE_PLUGINS)
@@ skipping 1044 matching lines @@
         // Similarly, if the history item just says to stay on about:blank,
         // don't load it again, which might clobber injected content.
         bool interrupted_by_client_redirect =
             frame_->isNavigationScheduledWithin(0) ||
             frame_->provisionalDataSource() ||
             !current_history_item_.isNull();
         bool staying_at_about_blank =
             current_history_item_.isNull() &&
             item_for_history_navigation.urlString() == url::kAboutBlankURL;
         if (staying_at_about_blank) {
-          // TODO(creis): We need to generate a commit for the initial empty
-          // document, rather than just faking a DidStopLoading.  See
-          // https://crbug.com/626416.
+          // TODO(creis): We should avoid the need to go to the browser and back
+          // when loading about:blank as a history item, which we can do by
+          // sending a subtree of same-process history items when navigating a
+          // frame back/forward (see https://crbug.com/639842).
+          //
+          // Until then, we need to fake a DidStopLoading, since there's no easy
+          // way to generate a commit for the initial empty document at this
+          // point in time.
+          //
+          // Note that the stopLoading call may run script which might delete
+          // this frame, so return immediately if this frame is no longer valid.
+          base::WeakPtr<RenderFrameImpl> weak_this = weak_factory_.GetWeakPtr();
           frame_->stopLoading();
+          if (!weak_this)
+            return;
         }
         if (request_params.is_history_navigation_in_new_child &&
             (interrupted_by_client_redirect || staying_at_about_blank)) {
           should_load_request = false;
           has_history_navigation_in_frame = false;
         }
 
         // Generate the request for the load from the HistoryItem.
         // PlzNavigate: use the data sent by the browser for the url and the
         // HTTP state. The restoration of user state such as scroll position
@@ skipping 764 matching lines @@
   // event target. Potentially a Pepper plugin will receive the event.
   // In order to tell whether a plugin gets the last mouse event and which it
   // is, we set |pepper_last_mouse_event_target_| to null here. If a plugin gets
   // the event, it will notify us via DidReceiveMouseEvent() and set itself as
   // |pepper_last_mouse_event_target_|.
   pepper_last_mouse_event_target_ = nullptr;
 #endif
 }
 
 }  // namespace content