Clear the owner element's widget in Document::shutdown().

third_party/WebKit/Source/core/frame/FrameView.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ skipping 329 matching lines @@
 
   // Destroy |m_autoSizeInfo| as early as possible, to avoid dereferencing
   // partially destroyed |this| via |m_autoSizeInfo->m_frameView|.
   m_autoSizeInfo.clear();
 
   m_postLayoutTasksTimer.stop();
   m_didScrollTimer.stop();
 
   // FIXME: Do we need to do something here for OOPI?
   HTMLFrameOwnerElement* ownerElement = m_frame->deprecatedLocalOwner();
-  // TODO(dcheng): It seems buggy that we can have an owner element that
-  // points to another Widget.
+  // TODO(dcheng): It seems buggy that we can have an owner element that points
+  // to another Widget. This can happen when a plugin element loads a frame
+  // (widget A of type FrameView) and then loads a plugin (widget B of type
+  // WebPluginContainerImpl). In this case, the frame's view is A and the frame
+  // element's owned widget is B. See https://crbug.com/673170 for an example.
   if (ownerElement && ownerElement->ownedWidget() == this)
     ownerElement->setWidget(nullptr);
 
 #if ENABLE(ASSERT)
   m_hasBeenDisposed = true;
 #endif
 }
 
 void FrameView::detachScrollbars() {
   // Previously, we detached custom scrollbars as early as possible to prevent
@@ skipping 4251 matching lines @@
   DCHECK(m_frame->isMainFrame());
   return m_initialViewportSize.width();
 }
 
 int FrameView::initialViewportHeight() const {
   DCHECK(m_frame->isMainFrame());
   return m_initialViewportSize.height();
 }
 
 }  // namespace blink