Clear the owner element's widget in Document::shutdown().

third_party/WebKit/Source/core/frame/FrameView.cpp

Index: third_party/WebKit/Source/core/frame/FrameView.cpp
diff --git a/third_party/WebKit/Source/core/frame/FrameView.cpp b/third_party/WebKit/Source/core/frame/FrameView.cpp
index 196f562691e386f9bdd7377e29038afb9aec1869..fe182f1b2001d9204bbd5bef927f82641fa694ae 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameView.cpp
@@ -350,9 +350,13 @@ void FrameView::dispose() {
 
   // FIXME: Do we need to do something here for OOPI?
   HTMLFrameOwnerElement* ownerElement = m_frame->deprecatedLocalOwner();
-  // TODO(dcheng): It seems buggy that we can have an owner element that
-  // points to another Widget.
-  if (ownerElement && ownerElement->ownedWidget() == this)
+  // TODO(dcheng): It seems buggy that we can have an owner element that points
+  // to another Widget. This can happen when a plugin element loads a frame
+  // (widget A of type FrameView) and then loads a plugin (widget B of type
+  // WebPluginContainerImpl). In this case, the frame's view is A and the frame
+  // element's owned widget is B. See https://crbug.com/673170 for an example.
+  // DCHECK(ownerElement->ownedWidget() == this);

[dcheng, 2016/12/14 02:23:00]

Nit: let's remove commented out code.

I don't think I completely understand what's going on here, but let's stop the
bleeding first =)

[Mariusz Mlynski, 2016/12/14 02:36:50]

This code is what @esprehn asked for :D I think we might want to leave it to
make sure the condition described in the comment is unambiguous.

+  if (ownerElement)
     ownerElement->setWidget(nullptr);
 
 #if ENABLE(ASSERT)