Clear the owner element's widget in Document::shutdown().

third_party/WebKit/Source/core/frame/FrameView.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ skipping 332 matching lines @@
 
   // Destroy |m_autoSizeInfo| as early as possible, to avoid dereferencing
   // partially destroyed |this| via |m_autoSizeInfo->m_frameView|.
   m_autoSizeInfo.clear();
 
   m_postLayoutTasksTimer.stop();
   m_didScrollTimer.stop();
 
   // FIXME: Do we need to do something here for OOPI?
   HTMLFrameOwnerElement* ownerElement = m_frame->deprecatedLocalOwner();
-  // TODO(dcheng): It seems buggy that we can have an owner element that
-  // points to another Widget.
-  if (ownerElement && ownerElement->ownedWidget() == this)
+  // TODO(dcheng): It seems buggy that we can have an owner element that points
+  // to another Widget. This can happen when a plugin element loads a frame
+  // (widget A of type FrameView) and then loads a plugin (widget B of type
+  // WebPluginContainerImpl). In this case, the frame's view is A and the frame
+  // element's owned widget is B. See https://crbug.com/673170 for an example.
+  // DCHECK(ownerElement->ownedWidget() == this);

[dcheng, 2016/12/14 02:23:00]

Nit: let's remove commented out code.

I don't think I completely understand what's going on here, but let's stop the
bleeding first =)

[Mariusz Mlynski, 2016/12/14 02:36:50]

This code is what @esprehn asked for :D I think we might want to leave it to
make sure the condition described in the comment is unambiguous.

+  if (ownerElement)
     ownerElement->setWidget(nullptr);
 
 #if ENABLE(ASSERT)
   m_hasBeenDisposed = true;
 #endif
 }
 
 void FrameView::detachScrollbars() {
   // Previously, we detached custom scrollbars as early as possible to prevent
   // Document::detachLayoutTree() from messing with the view such that its
@@ skipping 4303 matching lines @@
   DCHECK(m_frame->isMainFrame());
   return m_initialViewportSize.width();
 }
 
 int FrameView::initialViewportHeight() const {
   DCHECK(m_frame->isMainFrame());
   return m_initialViewportSize.height();
 }
 
 }  // namespace blink