Fix crash when a frame is detached while a PepperPluginInstance is being

content/renderer/pepper/pepper_plugin_instance_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bit_cast.h"
@@ skipping 522 matching lines @@
       is_deleted_(false),
       initialized_(false),
       audio_controller_(new PepperAudioController(this)),
       view_change_weak_ptr_factory_(this),
       weak_factory_(this) {
   pp_instance_ = HostGlobals::Get()->AddInstance(this);
 
   memset(&current_print_settings_, 0, sizeof(current_print_settings_));
   module_->InstanceCreated(this);
 
-  if (render_frame) {  // NULL in tests
-    render_frame->PepperInstanceCreated(this);
+  if (render_frame_) {  // NULL in tests or if the frame has been destroyed.
+    render_frame_->PepperInstanceCreated(this);

[bbudge, 2016/09/07 18:25:07]

I don't see how render_frame_ would be different from render_frame at this point
(before calling RenderFrameImpl::PepperInstanceCreated.) So how is this
different from before?

     view_data_.is_page_visible = !render_frame_->GetRenderWidget()->is_hidden();
 
     // Set the initial focus.
     SetContentAreaFocus(render_frame_->GetRenderWidget()->has_focus());
 
     if (!module_->IsProxied()) {
       PepperBrowserConnection* browser_connection =
           PepperBrowserConnection::Get(render_frame_);
       browser_connection->DidCreateInProcessInstance(
           pp_instance(),
@@ skipping 1582 matching lines @@
     return false;
   return bound_graphics_2d_platform_->PrepareTextureMailbox(mailbox,
                                                             release_callback);
 }
 
 void PepperPluginInstanceImpl::AccessibilityModeChanged() {
   if (render_frame_->render_accessibility() && LoadPdfInterface())
     plugin_pdf_interface_->EnableAccessibility(pp_instance());
 }
 
-void PepperPluginInstanceImpl::OnDestruct() { render_frame_ = NULL; }
+void PepperPluginInstanceImpl::OnDestruct() {
+  render_frame_ = nullptr;
+}
 
 void PepperPluginInstanceImpl::OnThrottleStateChange() {
   SendDidChangeView();
 
   bool is_throttled = throttler_->IsThrottled();
   render_frame()->Send(new FrameHostMsg_PluginInstanceThrottleStateChange(
       module_->GetPluginChildId(), pp_instance_, is_throttled));
 }
 
 void PepperPluginInstanceImpl::OnHiddenForPlaceholder(bool hidden) {
@@ skipping 1286 matching lines @@
     const cc::TextureMailbox& mailbox) const {
   auto it =
       std::find_if(texture_ref_counts_.begin(), texture_ref_counts_.end(),
                    [&mailbox](const TextureMailboxRefCount& ref_count) {
                      return ref_count.first.mailbox() == mailbox.mailbox();
                    });
   return it != texture_ref_counts_.end();
 }
 
 }  // namespace content