Move Frame to the Oilpan heap.

Source/web/PopupContainer.cpp

 /*
  * Copyright (c) 2011, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 222 matching lines @@
 void PopupContainer::hidePopup()
 {
     m_listBox->abandon();
 }
 
 void PopupContainer::notifyPopupHidden()
 {
     if (!m_popupOpen)
         return;
     m_popupOpen = false;
-    WebViewImpl::fromPage(m_frameView->frame().page())->popupClosed(this);
+
+    // With Oilpan, we cannot assume that the FrameView's LocalFrame's
+    // page is still available, as the LocalFrame itself may have been
+    // detached from its FrameHost by now.
+    //
+    // So, if a popup menu is left in an open/shown state when
+    // finalized, the PopupMenu implementation of this container's
+    // listbox will hide itself when destructed, delivering the
+    // notifyPopupHidden() notification in the process & ending up here.
+    // If the LocalFrame has been detached already -- done when its
+    // HTMLFrameOwnerElement frame owner is detached as part of being
+    // torn down -- the connection to the FrameHost has been snipped &
+    // there's no page. Hence the null check.
+    //
+    // In a non-Oilpan setting, the RenderMenuList that controls/owns
+    // the PopupMenuChromium object and this PopupContainer is torn
+    // down and destructed before the frame and frame owner, hence the
+    // page will always be available in that setting and this will
+    // not be an issue.
+    if (WebViewImpl* webView = WebViewImpl::fromPage(m_frameView->frame().page()))
+        webView->popupClosed(this);
 }
 
 void PopupContainer::fitToListBox()
 {
     // Place the listbox within our border.
     m_listBox->move(borderSize, borderSize);
 
     // Size ourselves to contain listbox + border.
     resize(m_listBox->width() + borderSize * 2, m_listBox->height() + borderSize * 2);
     invalidate();
@@ skipping 279 matching lines @@
 }
 
 IntPoint PopupContainer::convertSelfToChild(const Widget* child, const IntPoint& point) const
 {
     IntPoint newPoint = point;
     newPoint.moveBy(-child->location());
     return newPoint;
 }
 
 } // namespace blink