Don’t call functions on a possibly-deleted object

content/browser/web_contents/web_contents_impl.cc

Index: content/browser/web_contents/web_contents_impl.cc
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 18572e8f4826a6f64bdc6c2af133abee283e5ab9..207e1884377f31b2d13ae93c14a22d5e5a3c5a1a 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -4363,9 +4363,6 @@ void WebContentsImpl::RunJavaScriptDialog(RenderFrameHost* render_frame_host,
                    render_frame_host->GetRoutingID(), reply_msg,
                    true, false, base::string16());
   }
-
-  // OnDialogClosed (two lines up) may have caused deletion of this object (see
-  // http://crbug.com/288961 ). The only safe thing to do here is return.

[Charlie Reis, 2017/05/03 21:33:46]

Good find that this used to happen in
RenderFrameHostImpl::JavaScriptDialogClosed (due to https://crrev.com/61829). 
And yes, it doesn't happen anymore because dialogs aren't allowed during
beforeunload.

[Avi (use Gerrit), 2017/05/04 15:15:04]

2017 me is super grateful to 2013 me for the hint.

 }
 
 void WebContentsImpl::RunBeforeUnloadConfirm(
@@ -4383,7 +4380,7 @@ void WebContentsImpl::RunBeforeUnloadConfirm(
       delegate_->ShouldSuppressDialogs(this) ||
       !delegate_->GetJavaScriptDialogManager(this);
   if (suppress_this_message) {
-    rfhi->JavaScriptDialogClosed(reply_msg, true, base::string16(), true);
+    rfhi->JavaScriptDialogClosed(reply_msg, true, base::string16());
     return;
   }
 
@@ -5269,8 +5266,7 @@ void WebContentsImpl::OnDialogClosed(int render_process_id,
   }
 
   if (rfh) {
-    rfh->JavaScriptDialogClosed(reply_msg, success, user_input,
-                                dialog_was_suppressed);
+    rfh->JavaScriptDialogClosed(reply_msg, success, user_input);
   } else {
     // Don't leak the sync IPC reply if the RFH or process is gone.
     delete reply_msg;