Index: content/browser/android/content_view_core_impl.cc |
diff --git a/content/browser/android/content_view_core_impl.cc b/content/browser/android/content_view_core_impl.cc |
index c91af2e030d6eca1c1c536ed0f46913fe436e4f8..c40460ce2d296643fb59c34e10050ad0f75b6aec 100644 |
--- a/content/browser/android/content_view_core_impl.cc |
+++ b/content/browser/android/content_view_core_impl.cc |
@@ -272,6 +272,15 @@ void ContentViewCoreImpl::OnJavaContentViewCoreDestroyed(JNIEnv* env, |
jobject obj) { |
DCHECK(env->IsSameObject(java_ref_.get(env).obj(), obj)); |
java_ref_.reset(); |
+ // Java peer has gone, ContentViewCore is not functional and waits to |
+ // be destroyed with WebContents. |
+ // We need to reset WebContentsViewAndroid's reference, otherwise, there |
+ // could have call in when swapping the WebContents, |
+ // see http://crbug.com/383939 . |
+ DCHECK(web_contents_); |
+ static_cast<WebContentsViewAndroid*>( |
+ static_cast<WebContentsImpl*>(web_contents_)->GetView())-> |
+ SetContentViewCore(NULL); |
} |
void ContentViewCoreImpl::InitWebContents() { |