Move Frame to the Oilpan heap.

Source/web/PopupContainer.cpp

 /*
  * Copyright (c) 2011, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 222 matching lines @@
 void PopupContainer::hidePopup()
 {
     listBox()->abandon();
 }
 
 void PopupContainer::notifyPopupHidden()
 {
     if (!m_popupOpen)
         return;
     m_popupOpen = false;
-    WebViewImpl::fromPage(m_frameView->frame().page())->popupClosed(this);
+
+    // With Oilpan, we cannot assume that the FrameView's page
+    // is still available -- if the popup menu is left in an
+    // open/shown state when finalized, the PopupMenu implementation
+    // of this container's listbox may attempt to hide itself when
+    // destructed. That may happen longer after the FrameView has been
+    // closed and detached from its Frame (and Page), hence the need to check.

[haraken, 2014/09/08 07:25:59]

Actually I don't fully understand the lifetime relationship between the popups
and the WebView.

Why isn't WebViewImpl::closePagePopup() called and gracefully clear all popups
before the FrameView's page shuts down?

[sof, 2014/09/08 21:17:46]

There are quite a number of objects and abstractions to deal with when it comes
to popup handling & I don't claim to have grasped them all, but the problem
enters via the PopupMenuChromium finalizer (PopupMenuChromium is on the heap,
and implements PopupMenu and is a Member of RenderMenuList.) It will hide its
popup container, if that's needed.

If needed, the rendering related object is actually closed & PopupContainer will
eventually receive a notifyPopupHidden notification. And we end up here.

This may happen before or after the HTMLFrameOwnerElement is detached and
finalized. If it is finalized first, then its LocalFrame will become detached
from its FrameHost..and it will have no Page accessible. Hence the need for the
check here.

That's a very operational & low-level explanation of the "why" here, but the
only one I have. Notice that it is safe to access the FrameView's LocalFrame ,
as that's a Persistent. 

I've tried to improve the comment a bit.

+    if (WebViewImpl* webView = WebViewImpl::fromPage(m_frameView->frame().page()))
+        webView->popupClosed(this);
 }
 
 void PopupContainer::fitToListBox()
 {
     // Place the listbox within our border.
     m_listBox->move(borderSize, borderSize);
 
     // Size ourselves to contain listbox + border.
     resize(m_listBox->width() + borderSize * 2, m_listBox->height() + borderSize * 2);
     invalidate();
@@ skipping 254 matching lines @@
     }
 
     info->itemHeight = menuItemHeight();
     info->itemFontSize = menuItemFontSize();
     info->selectedIndex = selectedIndex();
     info->items.swap(outputItems);
     info->rightAligned = menuStyle().textDirection() == RTL;
 }
 
 } // namespace blink