Clear Document::m_frame after dispatching ContextLifecycleObesrver::contextDestroyed

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 4423b5be5a22df588b91743fcbe9156dd041266d..9c107592c0d797f84dfe57c01071d5e9ee4248ec 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -2270,13 +2270,6 @@ void Document::shutdown()
     m_timers.setTimerTaskRunner(
         Platform::current()->currentThread()->scheduler()->timerTaskRunner()->clone());
 
-    // This is required, as our LocalFrame might delete itself as soon as it detaches
-    // us. However, this violates Node::detachLayoutTree() semantics, as it's never
-    // possible to re-attach. Eventually Document::detachLayoutTree() should be renamed,
-    // or this setting of the frame to 0 could be made explicit in each of the
-    // callers of Document::detachLayoutTree().
-    m_frame = nullptr;
-
     if (m_mediaQueryMatcher)
         m_mediaQueryMatcher->documentDetached();
 
@@ -2289,6 +2282,13 @@ void Document::shutdown()
     // a contextDestroyed() notification. This can happen for a document
     // created by DOMImplementation::createDocument().
     ExecutionContext::notifyContextDestroyed();
+
+    // This is required, as our LocalFrame might delete itself as soon as it detaches
+    // us. However, this violates Node::detachLayoutTree() semantics, as it's never
+    // possible to re-attach. Eventually Document::detachLayoutTree() should be renamed,
+    // or this setting of the frame to 0 could be made explicit in each of the
+    // callers of Document::detachLayoutTree().
+    m_frame = nullptr;
 }
 
 void Document::removeAllEventListeners()