Fix crash when a frame is detached while a PepperPluginInstance is being constructed.

content/renderer/pepper/pepper_plugin_instance_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bit_cast.h"
@@ skipping 520 matching lines @@
       is_deleted_(false),
       initialized_(false),
       audio_controller_(new PepperAudioController(this)),
       view_change_weak_ptr_factory_(this),
       weak_factory_(this) {
   pp_instance_ = HostGlobals::Get()->AddInstance(this);
 
   memset(&current_print_settings_, 0, sizeof(current_print_settings_));
   module_->InstanceCreated(this);
 
-  if (render_frame) {  // NULL in tests
-    render_frame->PepperInstanceCreated(this);
+  if (render_frame_) {  // NULL in tests or if the frame has been destroyed.
+    render_frame_->PepperInstanceCreated(this);
     view_data_.is_page_visible = !render_frame_->GetRenderWidget()->is_hidden();
 
     // Set the initial focus.
     SetContentAreaFocus(render_frame_->GetRenderWidget()->has_focus());
 
     if (!module_->IsProxied()) {
       PepperBrowserConnection* browser_connection =
           PepperBrowserConnection::Get(render_frame_);
       browser_connection->DidCreateInProcessInstance(
           pp_instance(),
@@ skipping 2871 matching lines @@
     const cc::TextureMailbox& mailbox) const {
   auto it =
       std::find_if(texture_ref_counts_.begin(), texture_ref_counts_.end(),
                    [&mailbox](const TextureMailboxRefCount& ref_count) {
                      return ref_count.first.mailbox() == mailbox.mailbox();
                    });
   return it != texture_ref_counts_.end();
 }
 
 }  // namespace content