Don't assume a FrameHost from FrameView.

third_party/WebKit/Source/core/frame/FrameView.cpp

Index: third_party/WebKit/Source/core/frame/FrameView.cpp
diff --git a/third_party/WebKit/Source/core/frame/FrameView.cpp b/third_party/WebKit/Source/core/frame/FrameView.cpp
index 7d57db8ba1101988585e2c7c2cab6fa1d7b7b5f2..e8c6d1df8f0bcbf32caf5c34e57db0ce57c31ee0 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameView.cpp
@@ -329,9 +329,11 @@ void FrameView::dispose() {
   if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
     scrollingCoordinator->willDestroyScrollableArea(this);
 
-  FrameHost* frameHost = m_frame->host();
-  DCHECK(frameHost);
-  frameHost->globalRootScrollerController().didDisposeScrollableArea(*this);
+  // We need to check for host since there are situations where a plugin may
+  // get updated after its been detached. See crbug.com/671331 for details.
+  // This should be ok since plugins can't become the root scroller.
+  if (FrameHost* frameHost = m_frame->host())

[dcheng, 2016/12/12 21:32:46]

What's the stack where we hit this and it's null? In theory, we should only be
calling this when the frame has a currently active (i.e. not detached) Document.

+    frameHost->globalRootScrollerController().didDisposeScrollableArea(*this);
 
   // We need to clear the RootFrameViewport's animator since it gets called
   // from non-GC'd objects and RootFrameViewport will still have a pointer to
@@ -530,9 +532,6 @@ void FrameView::setFrameRect(const IntRect& newRect) {
     viewportSizeChanged(newRect.width() != oldRect.width(),
                         newRect.height() != oldRect.height());
 
-    if (m_frame->isMainFrame())
-      m_frame->host()->visualViewport().mainFrameDidChangeSize();
-
     frame().loader().restoreScrollPositionAndViewState();
   }
 }
@@ -1535,13 +1534,14 @@ void FrameView::viewportSizeChanged(bool widthChanged, bool heightChanged) {
       layoutView.compositor()->frameViewDidChangeSize();
   }
 
-  // Ensure the root scroller compositing layers update geometry in response to
-  // the URL bar resizing.
-  if (m_frame->isMainFrame()) {
-    m_frame->document()
-        ->frameHost()
-        ->globalRootScrollerController()
-        .mainFrameViewResized();
+  // We need to check for host since there are situations where a plugin may
+  // get updated after its been detached. See crbug.com/671331 for details.
+  if (m_frame->isMainFrame() && m_frame->host()) {
+    // Ensure the root scroller compositing layers update geometry in response
+    // to the URL bar resizing.
+    m_frame->host()->globalRootScrollerController().mainFrameViewResized();
+
+    m_frame->host()->visualViewport().mainFrameDidChangeSize();
   }
 
   showOverlayScrollbars();