Check for null RenderWidgetHostDelegate before canceling scroll bubble

content/browser/frame_host/cross_process_frame_connector.cc

Index: content/browser/frame_host/cross_process_frame_connector.cc
diff --git a/content/browser/frame_host/cross_process_frame_connector.cc b/content/browser/frame_host/cross_process_frame_connector.cc
index 09853dab02ac6fdab334dc056463307a2300c530..004b74d08894c2785fcb41d16f597dfd5f3bbf3b 100644
--- a/content/browser/frame_host/cross_process_frame_connector.cc
+++ b/content/browser/frame_host/cross_process_frame_connector.cc
@@ -55,7 +55,13 @@ void CrossProcessFrameConnector::set_view(
     RenderWidgetHostViewChildFrame* view) {
   // Detach ourselves from the previous |view_|.
   if (view_) {
-    if (is_scroll_bubbling_ && GetParentRenderWidgetHostView()) {
+    // The RenderWidgetHostDelegate needs to be checked because set_view() can
+    // be called during nested WebContents destruction. See
+    // https://crbug.com/644306.
+    if (is_scroll_bubbling_ && GetParentRenderWidgetHostView() &&
+        RenderWidgetHostImpl::From(
+            GetParentRenderWidgetHostView()->GetRenderWidgetHost())
+            ->delegate()) {
       RenderWidgetHostImpl::From(
           GetParentRenderWidgetHostView()->GetRenderWidgetHost())
           ->delegate()