Dispose a persisted plugin widget if the content frame is detached.

third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp b/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
index bb47c4e162da67daeeaabbc67f02d996527885c7..60960f26f49e1622bcd11ceda71c90c85bbf567e 100644
--- a/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
@@ -209,6 +209,8 @@ void HTMLPlugInElement::removedFrom(ContainerNode* insertionPoint) {
   // If we've persisted the plugin and we're removed from the tree then
   // make sure we cleanup the persistance pointer.
   if (m_persistedPluginWidget) {
+    // TODO(dcheng): This UpdateSuspendScope doesn't seem to provide much;
+    // investigate removing it.
     HTMLFrameOwnerElement::UpdateSuspendScope suspendWidgetHierarchyUpdates;
     setPersistedPluginWidget(nullptr);
   }
@@ -422,6 +424,11 @@ bool HTMLPlugInElement::isPluginElement() const {
   return true;
 }
 
+void HTMLPlugInElement::disconnectContentFrame() {
+  HTMLFrameOwnerElement::disconnectContentFrame();
+  setPersistedPluginWidget(nullptr);
+}
+
 bool HTMLPlugInElement::layoutObjectIsFocusable() const {
   if (HTMLFrameOwnerElement::supportsFocus() &&
       HTMLFrameOwnerElement::layoutObjectIsFocusable())