Index: content/renderer/render_frame_proxy.cc |
diff --git a/content/renderer/render_frame_proxy.cc b/content/renderer/render_frame_proxy.cc |
index 5af5f570fc8c0c946b22c1be6f96df2904087efe..0253b961f8ce52442f39c6d452cea07071cd3b13 100644 |
--- a/content/renderer/render_frame_proxy.cc |
+++ b/content/renderer/render_frame_proxy.cc |
@@ -195,6 +195,13 @@ void RenderFrameProxy::OnChildFrameProcessGone() { |
} |
void RenderFrameProxy::OnCompositorFrameSwapped(const IPC::Message& message) { |
+ // If this WebFrame has already been detached, its parent will be null. This |
+ // can happen when swapping a WebRemoteFrame with a WebLocalFrame, where this |
+ // message may arrive after the frame was removed from the frame tree, but |
+ // before the frame has been destroyed. http://crbug.com/446575. |
+ if (!web_frame()->parent()) |
+ return; |
+ |
FrameMsg_CompositorFrameSwapped::Param param; |
if (!FrameMsg_CompositorFrameSwapped::Read(&message, ¶m)) |
return; |