Don't assume a FrameHost from FrameView.

third_party/WebKit/Source/core/frame/FrameView.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ skipping 311 matching lines @@
 
   if (ScrollAnimatorBase* scrollAnimator = existingScrollAnimator())
     scrollAnimator->cancelAnimation();
   cancelProgrammaticScrollAnimation();
 
   detachScrollbars();
 
   if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
     scrollingCoordinator->willDestroyScrollableArea(this);
 
-  FrameHost* frameHost = m_frame->host();
-  DCHECK(frameHost);
-  frameHost->globalRootScrollerController().didDisposeScrollableArea(*this);
+  // We need to check for host since there are situations where a plugin may
+  // get updated after its been detached. See crbug.com/671331 for details.
+  // This should be ok since plugins can't become the root scroller.
+  if (FrameHost* frameHost = m_frame->host())

[dcheng, 2016/12/12 21:32:46]

What's the stack where we hit this and it's null? In theory, we should only be
calling this when the frame has a currently active (i.e. not detached) Document.

+    frameHost->globalRootScrollerController().didDisposeScrollableArea(*this);
 
   // We need to clear the RootFrameViewport's animator since it gets called
   // from non-GC'd objects and RootFrameViewport will still have a pointer to
   // this class.
   if (m_viewportScrollableArea)
     m_viewportScrollableArea->clearScrollableArea();
 
   clearScrollableArea();
 
   // Destroy |m_autoSizeInfo| as early as possible, to avoid dereferencing
@@ skipping 178 matching lines @@
   updateScrollbarsIfNeeded();
 
   frameRectsChanged();
 
   updateParentScrollableAreaSet();
 
   if (frameSizeChanged) {
     viewportSizeChanged(newRect.width() != oldRect.width(),
                         newRect.height() != oldRect.height());
 
-    if (m_frame->isMainFrame())
-      m_frame->host()->visualViewport().mainFrameDidChangeSize();
-
     frame().loader().restoreScrollPositionAndViewState();
   }
 }
 
 Page* FrameView::page() const {
   return frame().page();
 }
 
 LayoutView* FrameView::layoutView() const {
   return frame().contentLayoutObject();
@@ skipping 982 matching lines @@
 }
 
 void FrameView::viewportSizeChanged(bool widthChanged, bool heightChanged) {
   DCHECK(widthChanged || heightChanged);
 
   if (LayoutViewItem layoutView = this->layoutViewItem()) {
     if (layoutView.usesCompositing())
       layoutView.compositor()->frameViewDidChangeSize();
   }
 
-  // Ensure the root scroller compositing layers update geometry in response to
-  // the URL bar resizing.
-  if (m_frame->isMainFrame()) {
-    m_frame->document()
-        ->frameHost()
-        ->globalRootScrollerController()
-        .mainFrameViewResized();
+  // We need to check for host since there are situations where a plugin may
+  // get updated after its been detached. See crbug.com/671331 for details.
+  if (m_frame->isMainFrame() && m_frame->host()) {
+    // Ensure the root scroller compositing layers update geometry in response
+    // to the URL bar resizing.
+    m_frame->host()->globalRootScrollerController().mainFrameViewResized();
+
+    m_frame->host()->visualViewport().mainFrameDidChangeSize();
   }
 
   showOverlayScrollbars();
   if (RuntimeEnabledFeatures::rootLayerScrollingEnabled()) {
     // The background must be repainted when the FrameView is resized, even if
     // the initial containing block does not change (so we can't rely on layout
     // to issue the invalidation).  This is because the background fills the
     // main GraphicsLayer, which takes the size of the layout viewport.
     // TODO(skobes): Paint non-fixed backgrounds into the scrolling contents
     // layer and avoid this invalidation (http://crbug.com/568847).
@@ skipping 3109 matching lines @@
   DCHECK(m_frame->isMainFrame());
   return m_initialViewportSize.width();
 }
 
 int FrameView::initialViewportHeight() const {
   DCHECK(m_frame->isMainFrame());
   return m_initialViewportSize.height();
 }
 
 }  // namespace blink