Move Frame to the Oilpan heap.

Source/web/PopupContainer.cpp

Index: Source/web/PopupContainer.cpp
diff --git a/Source/web/PopupContainer.cpp b/Source/web/PopupContainer.cpp
index 35e901c5dbe44bff5bb384d306bc80ed3f159074..2cd76d0d44eab07619dec24301cbd7f7d7e7b049 100644
--- a/Source/web/PopupContainer.cpp
+++ b/Source/web/PopupContainer.cpp
@@ -240,7 +240,26 @@ void PopupContainer::notifyPopupHidden()
     if (!m_popupOpen)
         return;
     m_popupOpen = false;
-    WebViewImpl::fromPage(m_frameView->frame().page())->popupClosed(this);
+
+    // With Oilpan, we cannot assume that the FrameView's LocalFrame's
+    // page is still available, as the LocalFrame itself may have been
+    // detached from its FrameHost by now.
+    //
+    // So, if a popup menu is left in an open/shown state when
+    // finalized, the PopupMenu implementation of this container's
+    // listbox will hide itself when destructed, delivering this
+    // notifyPopupHidden() notification in the process. Should the
+    // LocalFrame have become detached first (when its
+    // HTMLFrameOwnerElement frame owner is detached as part of being
+    // finalized), the connection to the FrameHost has been snipped &
+    // there's no page. Hence the null check.
+    //
+    // (In a non-Oilpan setting, the object owning the PopupMenu and

[haraken, 2014/09/11 14:47:26]

Just help me understand: What's "the object"?

[sof, 2014/09/15 16:46:42]

A RenderMenuList would be what's controller/owner of this implementation of a
popup menu. Tried to add some more details & clarity to this comment.

+    // this PopupContainer is torn down and destructed before the
+    // frame and frame owner, hence the page will always be available
+    // here.)
+    if (WebViewImpl* webView = WebViewImpl::fromPage(m_frameView->frame().page()))
+        webView->popupClosed(this);
 }
 
 void PopupContainer::fitToListBox()