Move Frame to the Oilpan heap.

Source/web/PopupContainer.cpp

Index: Source/web/PopupContainer.cpp
diff --git a/Source/web/PopupContainer.cpp b/Source/web/PopupContainer.cpp
index 4b4ecdc998adf9690bda0162cc234cb121e13018..42de7f5366bb3e3d3ce151c6b87b13c73c61f444 100644
--- a/Source/web/PopupContainer.cpp
+++ b/Source/web/PopupContainer.cpp
@@ -240,7 +240,15 @@ void PopupContainer::notifyPopupHidden()
     if (!m_popupOpen)
         return;
     m_popupOpen = false;
-    WebViewImpl::fromPage(m_frameView->frame().page())->popupClosed(this);
+
+    // With Oilpan, we cannot assume that the FrameView's page
+    // is still available -- if the popup menu is left in an
+    // open/shown state when finalized, the PopupMenu implementation
+    // of this container's listbox may attempt to hide itself when
+    // destructed. That may happen longer after the FrameView has been

[Mads Ager (chromium), 2014/09/03 10:07:54]

longer -> long

+    // closed and detached from its Frame (and Page), hence the need to check.
+    if (WebViewImpl* webView = WebViewImpl::fromPage(m_frameView->frame().page()))
+        webView->popupClosed(this);
 }
 
 void PopupContainer::fitToListBox()