Move Frame to the Oilpan heap.

Source/web/PopupContainer.cpp

Index: Source/web/PopupContainer.cpp
diff --git a/Source/web/PopupContainer.cpp b/Source/web/PopupContainer.cpp
index 4b4ecdc998adf9690bda0162cc234cb121e13018..7a7c377e17bed44ea65430e4adfb02fe95056af0 100644
--- a/Source/web/PopupContainer.cpp
+++ b/Source/web/PopupContainer.cpp
@@ -240,7 +240,26 @@ void PopupContainer::notifyPopupHidden()
     if (!m_popupOpen)
         return;
     m_popupOpen = false;
-    WebViewImpl::fromPage(m_frameView->frame().page())->popupClosed(this);
+
+    // With Oilpan, we cannot assume that the FrameView's LocalFrame's
+    // page is still available, as the LocalFrame itself may have been
+    // detached from its FrameHost by now.
+    //
+    // So, if a popup menu is left in an open/shown state when
+    // finalized, the PopupMenu implementation of this container's
+    // listbox will hide itself when destructed, delivering this
+    // notifyPopupHidden() notification in the process. Should the
+    // LocalFrame have become detached first (when its
+    // HTMLFrameOwnerElement frame owner is detached as part of being
+    // finalized), the connection to the FrameHost has been snipped &
+    // there's no page. Hence the null check.
+    //
+    // (In a non-Oilpan setting, the object owning the PopupMenu and
+    // this PopupContainer is torn down and destructed before the
+    // frame and frame owner, hence the page will always be available
+    // here.)
+    if (WebViewImpl* webView = WebViewImpl::fromPage(m_frameView->frame().page()))
+        webView->popupClosed(this);
 }
 
 void PopupContainer::fitToListBox()