Check for null RenderWidgetHostDelegate before canceling scroll bubble

content/browser/frame_host/cross_process_frame_connector.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 
 #include "cc/surfaces/surface.h"
 #include "cc/surfaces/surface_hittest.h"
 #include "cc/surfaces/surface_manager.h"
 #include "content/browser/compositor/surface_utils.h"
@@ skipping 37 matching lines @@
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
 
   return handled;
 }
 
 void CrossProcessFrameConnector::set_view(
     RenderWidgetHostViewChildFrame* view) {
   // Detach ourselves from the previous |view_|.
   if (view_) {
-    if (is_scroll_bubbling_ && GetParentRenderWidgetHostView()) {
+    // The RenderWidgetHostDelegate needs to be checked because set_view() can
+    // be called during nested WebContents destruction. See
+    // https://crbug.com/644306.
+    if (is_scroll_bubbling_ && GetParentRenderWidgetHostView() &&
+        RenderWidgetHostImpl::From(
+            GetParentRenderWidgetHostView()->GetRenderWidgetHost())
+            ->delegate()) {
       RenderWidgetHostImpl::From(
           GetParentRenderWidgetHostView()->GetRenderWidgetHost())
           ->delegate()
           ->GetInputEventRouter()
           ->CancelScrollBubbling(view_);
       is_scroll_bubbling_ = false;
     }
     view_->SetCrossProcessFrameConnector(nullptr);
   }
 
@@ skipping 294 matching lines @@
 
   if (parent) {
     return static_cast<RenderWidgetHostViewBase*>(
         parent->current_frame_host()->GetView());
   }
 
   return nullptr;
 }
 
 }  // namespace content