Fix for crash when attaching a frame in WebUI renderer.

content/renderer/web_ui_extension.cc

Index: content/renderer/web_ui_extension.cc
diff --git a/content/renderer/web_ui_extension.cc b/content/renderer/web_ui_extension.cc
index 11565f2b4acb6f85e9e0695bb04b2d4fd05dffba..c1e799be18b6788840792b3416f07f8ed936dd66 100644
--- a/content/renderer/web_ui_extension.cc
+++ b/content/renderer/web_ui_extension.cc
@@ -70,11 +70,14 @@ void WebUIExtension::Install(blink::WebFrame* frame) {
   v8::Context::Scope context_scope(context);
 
   v8::Handle<v8::Object> global = context->Global();
-  v8::Handle<v8::Object> chrome =
-      global->Get(gin::StringToV8(isolate, "chrome"))->ToObject();
-  if (chrome.IsEmpty()) {
+  v8::Handle<v8::Object> chrome;
+  v8::Handle<v8::Value> chrome_value =
+      global->Get(gin::StringToV8(isolate, "chrome"));
+  if (chrome_value.IsEmpty() || !chrome_value->IsObject()) {

[Mike West, 2014/09/30 07:51:46]

Please adjust skia_benchmarking_extension and memory_benchmarking_extension as
well; right now this code hits the bug because it's the first one to be
initialized. If the ordering of 'RenderViewImpl::didClearWindowObject' changes,
one of those might run into the same issue.

It might even be worthwhile to extract this snippet to a static method somewhere
to ensure that 'chrome' always gets set up correctly.

     chrome = v8::Object::New(isolate);
     global->Set(gin::StringToSymbol(isolate, "chrome"), chrome);
+  } else {
+    chrome = chrome_value->ToObject();
   }
   chrome->Set(gin::StringToSymbol(isolate, "send"),
               gin::CreateFunctionTemplate(