Fix a crash in MediaSessionServiceImpl due to life time issue

content/browser/media/session/media_session_impl.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/media/session/media_session_impl.h"
 
 #include <algorithm>
 #include "content/browser/media/session/audio_focus_delegate.h"
 #include "content/browser/media/session/media_session_controller.h"
 #include "content/browser/media/session/media_session_player_observer.h"
@@ skipping 92 matching lines @@
   // TODO(zqzhang): refactor MediaSessionImpl, maybe move the interface used to
   // talk with AudioFocusManager out to a seperate class. The AudioFocusManager
   // unit tests then could mock the interface and abandon audio focus when
   // WebContents is destroyed. See https://crbug.com/651069
   normal_players_.clear();
   pepper_players_.clear();
   one_shot_players_.clear();
   AbandonSystemAudioFocusIfNeeded();
 }
 
+void MediaSessionImpl::RenderFrameDeleted(RenderFrameHost* rfh) {
+  if (services_.count(rfh))
+    OnServiceDestroyed(services_[rfh]);
+}
+
 void MediaSessionImpl::AddObserver(MediaSessionObserver* observer) {
   observers_.AddObserver(observer);
 }
 
 void MediaSessionImpl::RemoveObserver(MediaSessionObserver* observer) {
   observers_.RemoveObserver(observer);
 }
 
 void MediaSessionImpl::NotifyMediaSessionMetadataChange(
     const base::Optional<MediaMetadata>& metadata) {
@@ skipping 444 matching lines @@
 
   one_shot_players_.insert(PlayerIdentifier(observer, player_id));
   NotifyAboutStateChange();
 
   return true;
 }
 
 // MediaSessionService-related methods
 
 void MediaSessionImpl::OnServiceCreated(MediaSessionServiceImpl* service) {
-  services_[service->GetRenderFrameHost()] = service;
+  RenderFrameHost* rfh = service->GetRenderFrameHost();
+  if (!rfh)
+    return;
+
+  services_[rfh] = service;
   UpdateRoutedService();
 }
 
 void MediaSessionImpl::OnServiceDestroyed(MediaSessionServiceImpl* service) {
   services_.erase(service->GetRenderFrameHost());
   if (routed_service_ == service) {
     routed_service_ = nullptr;
     UpdateRoutedService();
   }
 }
@@ skipping 112 matching lines @@
     if (!IsServiceActiveForRenderFrameHost(frame))
       continue;
     best_frame = frame;
     min_depth = depth;
   }
 
   return best_frame ? services_[best_frame] : nullptr;
 }
 
 }  // namespace content