Avoid use-after-free when InterstitialPageImpl is being torn down.

content/browser/frame_host/interstitial_page_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/interstitial_page_impl.h"
 
 #include <utility>
 #include <vector>
 
 #include "base/bind.h"
@@ skipping 789 matching lines @@
     SiteInstance* instance) {
   return session_storage_namespace_.get();
 }
 
 FrameTree* InterstitialPageImpl::GetFrameTree() {
   return frame_tree_.get();
 }
 
 void InterstitialPageImpl::Disable() {
   enabled_ = false;
+
+  // Also let the InterstitialPageNavigatorImpl know.
+  static_cast<InterstitialPageNavigatorImpl*>(frame_tree_->root()->navigator())
+      ->Disable();
 }
 
 void InterstitialPageImpl::Shutdown() {
   delete this;
 }
 
 void InterstitialPageImpl::OnNavigatingAwayOrTabClosing() {
   if (action_taken_ == NO_ACTION) {
     // We are navigating away from the interstitial or closing a tab with an
     // interstitial.  Default to DontProceed(). We don't just call Hide as
@@ skipping 168 matching lines @@
 RenderWidgetHostInputEventRouter* InterstitialPageImpl::GetInputEventRouter() {
   WebContentsImpl* web_contents_impl =
       static_cast<WebContentsImpl*>(web_contents_);
   if (!web_contents_impl)
     return nullptr;
 
   return web_contents_impl->GetInputEventRouter();
 }
 
 }  // namespace content