Null out a field in the RenderFrameHostImpl dtor.

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 72d53245905548c7587908e18958539a1e3f6875..80c087768461186bf34ec1aee6d39a6928421453 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -175,6 +175,10 @@ RenderFrameHostImpl::~RenderFrameHostImpl() {
   // Notify the FrameTree that this RFH is going away, allowing it to shut down
   // the corresponding RenderViewHost if it is no longer needed.
   frame_tree_->UnregisterRenderFrameHost(this);
+
+  // NULL out the swapout timer; in crash dumps this member will be null only if
+  // the dtor has run.
+  swapout_event_monitor_timeout_.reset();

[Evan Stade, 2014/12/10 22:02:18]

sorta surprised scoped_ptr doesn't already null out the pointer in its
destructor

[ncarter (slow), 2014/12/10 22:09:50]

I was surprised too, but it turns out that ~scoped_ptr_impl just invokes the
deleter (versus calling reset(), which would write nullptr to the ptr field).
Relevant lines:

https://code.google.com/p/chromium/codesearch#chromium/src/base/memory/scoped...

https://code.google.com/p/chromium/codesearch#chromium/src/base/memory/scoped...

 }
 
 int RenderFrameHostImpl::GetRoutingID() {