Fix for crash when attaching a frame in WebUI renderer.

content/renderer/web_ui_extension.cc

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/web_ui_extension.h"
 
 #include "base/memory/scoped_ptr.h"
 #include "base/values.h"
 #include "content/common/view_messages.h"
 #include "content/public/common/bindings_policy.h"
@@ skipping 52 matching lines @@
 void WebUIExtension::Install(blink::WebFrame* frame) {
   v8::Isolate* isolate = blink::mainThreadIsolate();
   v8::HandleScope handle_scope(isolate);
   v8::Handle<v8::Context> context = frame->mainWorldScriptContext();
   if (context.IsEmpty())
     return;
 
   v8::Context::Scope context_scope(context);
 
   v8::Handle<v8::Object> global = context->Global();
-  v8::Handle<v8::Object> chrome =
-      global->Get(gin::StringToV8(isolate, "chrome"))->ToObject();
-  if (chrome.IsEmpty()) {
+  v8::Handle<v8::Object> chrome;
+  v8::Handle<v8::Value> chrome_value =
+      global->Get(gin::StringToV8(isolate, "chrome"));
+  if (chrome_value.IsEmpty() || !chrome_value->IsObject()) {

[Mike West, 2014/09/30 07:51:46]

Please adjust skia_benchmarking_extension and memory_benchmarking_extension as
well; right now this code hits the bug because it's the first one to be
initialized. If the ordering of 'RenderViewImpl::didClearWindowObject' changes,
one of those might run into the same issue.

It might even be worthwhile to extract this snippet to a static method somewhere
to ensure that 'chrome' always gets set up correctly.

     chrome = v8::Object::New(isolate);
     global->Set(gin::StringToSymbol(isolate, "chrome"), chrome);
+  } else {
+    chrome = chrome_value->ToObject();
   }
   chrome->Set(gin::StringToSymbol(isolate, "send"),
               gin::CreateFunctionTemplate(
                   isolate, base::Bind(&WebUIExtension::Send))->GetFunction());
   chrome->Set(gin::StringToSymbol(isolate, "getVariableValue"),
               gin::CreateFunctionTemplate(
                   isolate, base::Bind(&WebUIExtension::GetVariableValue))
                   ->GetFunction());
 }
 
@@ skipping 43 matching lines @@
 std::string WebUIExtension::GetVariableValue(const std::string& name) {
   blink::WebFrame* frame;
   RenderView* render_view;
   if (!ShouldRespondToRequest(&frame, &render_view))
     return std::string();
 
   return WebUIExtensionData::Get(render_view)->GetValue(name);
 }
 
 }  // namespace content