Fix crash caused by the detached iframe

Reproduced the crash locally, but it needs a little bit more work
to write a test, this patch has fix only, following up patch will
add test.

Bug: 792327
Change-Id: I76d8dbc51b84b0aca87f09e162fc97d870881ca9
Reviewed-on: https://chromium-review.googlesource.com/813195Reviewed-by: Mathieu Perreault <mathp@chromium.org>
Reviewed-by: Roger McFarlane <rogerm@chromium.org>
Commit-Queue: Tao Bai <michaelbai@chromium.org>
Cr-Commit-Position: refs/heads/master@{#522459}

components/autofill/content/renderer/autofill_agent.cc

@@ -824,9 +824,20 @@ void AutofillAgent::OnInferredFormSubmission(SubmissionSource source) {
     return;
   }
 
-  FormData form_data;
-  if (GetSubmittedForm(&form_data)) {
-    FireHostSubmitEvents(form_data, /*known_success=*/true);
+  if (source == SubmissionSource::FRAME_DETACHED) {
+    // Should not access the frame because it is now detached. Instead, use
+    // |constructed_form_| or |last_interacted_form_| depending on whether the
+    // form is formless or not.
+    if (!last_interacted_form_.IsNull()) {
+      FireHostSubmitEvents(last_interacted_form_, /*known_success=*/true);
+    } else if (constructed_form_) {
+      FireHostSubmitEvents(*constructed_form_, /*known_success=*/true);
+    }
+  } else {
+    FormData form_data;
+    if (GetSubmittedForm(&form_data)) {
+      FireHostSubmitEvents(form_data, /*known_success=*/true);
+    }
   }
   ResetLastInteractedElements();
 }