Fix crash when de-referencing the WebFrameWidget.

third_party/WebKit/Source/web/WebViewImpl.cpp

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 2518 matching lines @@
     page()->willCloseLayerTreeView(*m_layerTreeView, nullptr);
 
   setRootLayer(nullptr);
   m_animationHost = nullptr;
 
   m_mutator = nullptr;
   m_layerTreeView = nullptr;
 }
 
 void WebViewImpl::didAcquirePointerLock() {
-  mainFrameImpl()->frameWidget()->didAcquirePointerLock();
+  if (mainFrameImpl())
+    mainFrameImpl()->frameWidget()->didAcquirePointerLock();
 }
 
 void WebViewImpl::didNotAcquirePointerLock() {
-  mainFrameImpl()->frameWidget()->didNotAcquirePointerLock();
+  if (mainFrameImpl())
+    mainFrameImpl()->frameWidget()->didNotAcquirePointerLock();
 }
 
 void WebViewImpl::didLosePointerLock() {
-  mainFrameImpl()->frameWidget()->didLosePointerLock();
+  if (mainFrameImpl())

[dcheng, 2017/03/03 23:57:24]

Please add some comments here too to document the race.

[lfg, 2017/03/06 21:31:01]

Done.

+    mainFrameImpl()->frameWidget()->didLosePointerLock();
 }
 
 // TODO(ekaramad):This method is almost duplicated in WebFrameWidgetImpl as
 // well. This code needs to be refactored  (http://crbug.com/629721).
 bool WebViewImpl::getCompositionCharacterBounds(WebVector<WebRect>& bounds) {
   WebRange range = compositionRange();
   if (range.isEmpty())
     return false;
 
   WebLocalFrame* frame = focusedFrame();
@@ skipping 1604 matching lines @@
   if (focusedFrame->localFrameRoot() != mainFrameImpl()->frame())
     return nullptr;
   return focusedFrame;
 }
 
 LocalFrame* WebViewImpl::focusedLocalFrameAvailableForIme() const {
   return m_imeAcceptEvents ? focusedLocalFrameInWidget() : nullptr;
 }
 
 }  // namespace blink