Move Frame to the Oilpan heap.

Source/web/PopupContainer.cpp

 /*
  * Copyright (c) 2011, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 222 matching lines @@
 void PopupContainer::hidePopup()
 {
     listBox()->abandon();
 }
 
 void PopupContainer::notifyPopupHidden()
 {
     if (!m_popupOpen)
         return;
     m_popupOpen = false;
-    WebViewImpl::fromPage(m_frameView->frame().page())->popupClosed(this);
+
+    // With Oilpan, we cannot assume that the FrameView's LocalFrame's
+    // page is still available, as the LocalFrame itself may have been
+    // detached from its FrameHost by now.
+    //
+    // So, if a popup menu is left in an open/shown state when
+    // finalized, the PopupMenu implementation of this container's
+    // listbox will hide itself when destructed, delivering this
+    // notifyPopupHidden() notification in the process. Should the
+    // LocalFrame have become detached first (when its
+    // HTMLFrameOwnerElement frame owner is detached as part of being
+    // finalized), the connection to the FrameHost has been snipped &
+    // there's no page. Hence the null check.
+    //
+    // (In a non-Oilpan setting, the object owning the PopupMenu and
+    // this PopupContainer is torn down and destructed before the
+    // frame and frame owner, hence the page will always be available
+    // here.)
+    if (WebViewImpl* webView = WebViewImpl::fromPage(m_frameView->frame().page()))
+        webView->popupClosed(this);
 }
 
 void PopupContainer::fitToListBox()
 {
     // Place the listbox within our border.
     m_listBox->move(borderSize, borderSize);
 
     // Size ourselves to contain listbox + border.
     resize(m_listBox->width() + borderSize * 2, m_listBox->height() + borderSize * 2);
     invalidate();
@@ skipping 254 matching lines @@
     }
 
     info->itemHeight = menuItemHeight();
     info->itemFontSize = menuItemFontSize();
     info->selectedIndex = selectedIndex();
     info->items.swap(outputItems);
     info->rightAligned = menuStyle().textDirection() == RTL;
 }
 
 } // namespace blink