Ensure that entries are correctly removed from the MimeHandlerViewContainer map

Currently if the RenderFrame is destroyed prior to the MimeHandlerViewContainer
then we will look for the wrong entry in the map. This fixes that issue by
removing the entry when the RenderFrame is destroyed.

Review URL: https://codereview.chromium.org/874293004

Cr-Commit-Position: refs/heads/master@{#313418}

4 files changed, 18 insertions, 3 deletions

diff --git a/extensions/renderer/guest_view/guest_view_container.cc b/extensions/renderer/guest_view/guest_view_container.cc
index 3416428..a6ce352 100644
--- a/extensions/renderer/guest_view/guest_view_container.cc
+++ b/extensions/renderer/guest_view/guest_view_container.cc
@@ -61,6 +61,7 @@ bool GuestViewContainer::HandlesMessage(const IPC::Message& msg) {
 }
 
 void GuestViewContainer::RenderFrameDestroyed() {
+  OnRenderFrameDestroyed();
   render_frame_ = nullptr;
 }
 
diff --git a/extensions/renderer/guest_view/guest_view_container.h b/extensions/renderer/guest_view/guest_view_container.h
index df460cf..85af57a 100644
--- a/extensions/renderer/guest_view/guest_view_container.h
+++ b/extensions/renderer/guest_view/guest_view_container.h
@@ -28,6 +28,8 @@ class GuestViewContainer : public content::BrowserPluginDelegate {
   int render_view_routing_id() const { return render_view_routing_id_; }
   content::RenderFrame* render_frame() const { return render_frame_; }
 
+  virtual void OnRenderFrameDestroyed() {}
+
  private:
   class RenderFrameLifetimeObserver;
 
diff --git a/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc b/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc
index 9c50256..59f8340 100644
--- a/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc
+++ b/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc
@@ -102,9 +102,11 @@ MimeHandlerViewContainer::~MimeHandlerViewContainer() {
   if (loader_)
     loader_->cancel();
 
-  g_mime_handler_view_container_map.Get()[render_frame()].erase(this);
-  if (g_mime_handler_view_container_map.Get()[render_frame()].empty())
-    g_mime_handler_view_container_map.Get().erase(render_frame());
+  if (render_frame()) {
+    g_mime_handler_view_container_map.Get()[render_frame()].erase(this);
+    if (g_mime_handler_view_container_map.Get()[render_frame()].empty())
+      g_mime_handler_view_container_map.Get().erase(render_frame());
+  }
 }
 
 // static
@@ -119,6 +121,9 @@ MimeHandlerViewContainer::FromRenderFrame(content::RenderFrame* render_frame) {
 }
 
 void MimeHandlerViewContainer::Ready() {
+  if (!render_frame())
+    return;
+
   blink::WebFrame* frame = render_frame()->GetWebFrame();
   blink::WebURLLoaderOptions options;
   // The embedded plugin is allowed to be cross-origin.
@@ -137,6 +142,10 @@ void MimeHandlerViewContainer::DidFinishLoading() {
   CreateMimeHandlerViewGuest();
 }
 
+void MimeHandlerViewContainer::OnRenderFrameDestroyed() {
+  g_mime_handler_view_container_map.Get().erase(render_frame());
+}
+
 void MimeHandlerViewContainer::DidReceiveData(const char* data,
                                               int data_length) {
   view_id_ += std::string(data, data_length);
diff --git a/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.h b/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.h
index 86183f1..b7cee75 100644
--- a/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.h
+++ b/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.h
@@ -65,6 +65,9 @@ class MimeHandlerViewContainer : public GuestViewContainer,
                         double finish_time,
                         int64_t total_encoded_data_length) override;
 
+  // GuestViewContainer overrides.
+  void OnRenderFrameDestroyed() override;
+
   // Post a JavaScript message to the guest.
   void PostMessage(v8::Isolate* isolate,
                    v8::Handle<v8::Value> message);