devtools: Fix crash when WebContents is deleted by a message handler

If a DevTools message handler deletes the WebContents which originated
the message, we previously tried to access a member of an already-freed
FrameHostHolder.

TEST=headless_browsertests --gtest_filter=HeadlessBrowserContextIsolationTest.RunAsyncTest

Review-Url: https://codereview.chromium.org/2597453002
Cr-Commit-Position: refs/heads/master@{#439879}

content/browser/devtools/render_frame_devtools_agent_host.cc

@@ -242,13 +242,15 @@ void RenderFrameDevToolsAgentHost::FrameHostHolder::SendMessageToClient(
     int session_id,
     const std::string& message) {
   int id = chunk_processor_.last_call_id();
+  PendingMessage sent_message = sent_messages_[id];
+  sent_messages_.erase(id);
   if (suspended_) {
-    sent_messages_whose_reply_came_while_suspended_[id] = sent_messages_[id];
+    sent_messages_whose_reply_came_while_suspended_[id] = sent_message;
     pending_messages_.push_back(std::make_pair(session_id, message));
   } else {
     agent_->SendMessageToClient(session_id, message);
+    // |this| may be deleted at this point.
   }
-  sent_messages_.erase(id);
 }
 
 void RenderFrameDevToolsAgentHost::FrameHostHolder::Suspend() {