Move Frame to the Oilpan heap.

Source/web/PopupContainer.cpp

Index: Source/web/PopupContainer.cpp
diff --git a/Source/web/PopupContainer.cpp b/Source/web/PopupContainer.cpp
index 4b4ecdc998adf9690bda0162cc234cb121e13018..42de7f5366bb3e3d3ce151c6b87b13c73c61f444 100644
--- a/Source/web/PopupContainer.cpp
+++ b/Source/web/PopupContainer.cpp
@@ -240,7 +240,15 @@ void PopupContainer::notifyPopupHidden()
     if (!m_popupOpen)
         return;
     m_popupOpen = false;
-    WebViewImpl::fromPage(m_frameView->frame().page())->popupClosed(this);
+
+    // With Oilpan, we cannot assume that the FrameView's page
+    // is still available -- if the popup menu is left in an
+    // open/shown state when finalized, the PopupMenu implementation
+    // of this container's listbox may attempt to hide itself when
+    // destructed. That may happen longer after the FrameView has been
+    // closed and detached from its Frame (and Page), hence the need to check.

[haraken, 2014/09/08 07:25:59]

Actually I don't fully understand the lifetime relationship between the popups
and the WebView.

Why isn't WebViewImpl::closePagePopup() called and gracefully clear all popups
before the FrameView's page shuts down?

[sof, 2014/09/08 21:17:46]

There are quite a number of objects and abstractions to deal with when it comes
to popup handling & I don't claim to have grasped them all, but the problem
enters via the PopupMenuChromium finalizer (PopupMenuChromium is on the heap,
and implements PopupMenu and is a Member of RenderMenuList.) It will hide its
popup container, if that's needed.

If needed, the rendering related object is actually closed & PopupContainer will
eventually receive a notifyPopupHidden notification. And we end up here.

This may happen before or after the HTMLFrameOwnerElement is detached and
finalized. If it is finalized first, then its LocalFrame will become detached
from its FrameHost..and it will have no Page accessible. Hence the need for the
check here.

That's a very operational & low-level explanation of the "why" here, but the
only one I have. Notice that it is safe to access the FrameView's LocalFrame ,
as that's a Persistent. 

I've tried to improve the comment a bit.

+    if (WebViewImpl* webView = WebViewImpl::fromPage(m_frameView->frame().page()))
+        webView->popupClosed(this);
 }
 
 void PopupContainer::fitToListBox()