Do not SendPasswordForms when LocalFrame is being detached

components/autofill/content/renderer/password_autofill_agent.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/autofill/content/renderer/password_autofill_agent.h"
 
 #include <stddef.h>
 
 #include <memory>
 #include <string>
@@ skipping 928 matching lines @@
 
 void PasswordAutofillAgent::SendPasswordForms(bool only_visible) {
   std::unique_ptr<RendererSavePasswordProgressLogger> logger;
   if (logging_state_active_) {
     logger.reset(new RendererSavePasswordProgressLogger(
         GetPasswordManagerDriver().get()));
     logger->LogMessage(Logger::STRING_SEND_PASSWORD_FORMS_METHOD);
     logger->LogBoolean(Logger::STRING_ONLY_VISIBLE, only_visible);
   }
 
-  blink::WebFrame* frame = render_frame()->GetWebFrame();
+  blink::WebLocalFrame* frame = render_frame()->GetWebFrame();
+  // RenderFrameObserver::DidFinishLoad() can fire when Frame is
+  // detaching. crbug.com/654654
+  if (frame->isFrameDetachedForSpecialOneOffStopTheCrashingHackBug561873())
+    return;
+
   // Make sure that this security origin is allowed to use password manager.
   blink::WebSecurityOrigin origin = frame->document().getSecurityOrigin();
   if (logger) {
     logger->LogURL(Logger::STRING_SECURITY_ORIGIN,
                    GURL(origin.toString().utf8()));
   }
   if (!OriginCanAccessPasswordManager(origin)) {
     if (logger) {
       logger->LogMessage(Logger::STRING_SECURITY_ORIGIN_FAILURE);
     }
@@ skipping 541 matching lines @@
 PasswordAutofillAgent::GetPasswordManagerDriver() {
   if (!password_manager_driver_) {
     render_frame()->GetRemoteInterfaces()->GetInterface(
         mojo::GetProxy(&password_manager_driver_));
   }
 
   return password_manager_driver_;
 }
 
 }  // namespace autofill