devtools: Fix crash when WebContents is deleted by a message handler

content/browser/devtools/render_frame_devtools_agent_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/devtools/render_frame_devtools_agent_host.h"
 
 #include <tuple>
 #include <utility>
 
 #include "base/guid.h"
@@ skipping 224 matching lines @@
 bool
 RenderFrameDevToolsAgentHost::FrameHostHolder::ProcessChunkedMessageFromAgent(
     const DevToolsMessageChunk& chunk) {
   return chunk_processor_.ProcessChunkedMessageFromAgent(chunk);
 }
 
 void RenderFrameDevToolsAgentHost::FrameHostHolder::SendMessageToClient(
     int session_id,
     const std::string& message) {
   int id = chunk_processor_.last_call_id();
+  PendingMessage sent_message = sent_messages_[id];
+  sent_messages_.erase(id);
   if (suspended_) {
-    sent_messages_whose_reply_came_while_suspended_[id] = sent_messages_[id];
+    sent_messages_whose_reply_came_while_suspended_[id] = sent_message;
     pending_messages_.push_back(std::make_pair(session_id, message));
   } else {
     agent_->SendMessageToClient(session_id, message);
+    // |this| may be deleted at this point.
   }
-  sent_messages_.erase(id);
 }
 
 void RenderFrameDevToolsAgentHost::FrameHostHolder::Suspend() {
   suspended_ = true;
 }
 
 void RenderFrameDevToolsAgentHost::FrameHostHolder::Resume() {
   suspended_ = false;
   for (const auto& pair : pending_messages_)
     agent_->SendMessageToClient(pair.first, pair.second);
@@ skipping 947 matching lines @@
     RenderFrameHost* host) {
   return (current_ && current_->host() == host) ||
       (pending_ && pending_->host() == host);
 }
 
 bool RenderFrameDevToolsAgentHost::IsChildFrame() {
   return current_ && current_->host()->GetParent();
 }
 
 }  // namespace content