Ensure that entries are correctly removed from the MimeHandlerViewContainer map

Currently if the RenderFrame is destroyed prior to the MimeHandlerViewContainer
then we will look for the wrong entry in the map. This fixes that issue by
removing the entry when the RenderFrame is destroyed.

Review URL: https://codereview.chromium.org/874293004

Cr-Commit-Position: refs/heads/master@{#313418}

extensions/renderer/guest_view/guest_view_container.cc

@@ -61,6 +61,7 @@ bool GuestViewContainer::HandlesMessage(const IPC::Message& msg) {
 }
 
 void GuestViewContainer::RenderFrameDestroyed() {
+  OnRenderFrameDestroyed();
   render_frame_ = nullptr;
 }
 

extensions/renderer/guest_view/guest_view_container.h

@@ -28,6 +28,8 @@ class GuestViewContainer : public content::BrowserPluginDelegate {
   int render_view_routing_id() const { return render_view_routing_id_; }
   content::RenderFrame* render_frame() const { return render_frame_; }
 
+  virtual void OnRenderFrameDestroyed() {}
+
  private:
   class RenderFrameLifetimeObserver;
 

extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc

@@ -102,9 +102,11 @@ MimeHandlerViewContainer::~MimeHandlerViewContainer() {
   if (loader_)
     loader_->cancel();
 
-  g_mime_handler_view_container_map.Get()[render_frame()].erase(this);
-  if (g_mime_handler_view_container_map.Get()[render_frame()].empty())
-    g_mime_handler_view_container_map.Get().erase(render_frame());
+  if (render_frame()) {
+    g_mime_handler_view_container_map.Get()[render_frame()].erase(this);
+    if (g_mime_handler_view_container_map.Get()[render_frame()].empty())
+      g_mime_handler_view_container_map.Get().erase(render_frame());
+  }
 }
 
 // static
@@ -119,6 +121,9 @@ MimeHandlerViewContainer::FromRenderFrame(content::RenderFrame* render_frame) {
 }
 
 void MimeHandlerViewContainer::Ready() {
+  if (!render_frame())
+    return;
+
   blink::WebFrame* frame = render_frame()->GetWebFrame();
   blink::WebURLLoaderOptions options;
   // The embedded plugin is allowed to be cross-origin.
@@ -137,6 +142,10 @@ void MimeHandlerViewContainer::DidFinishLoading() {
   CreateMimeHandlerViewGuest();
 }
 
+void MimeHandlerViewContainer::OnRenderFrameDestroyed() {
+  g_mime_handler_view_container_map.Get().erase(render_frame());
+}
+
 void MimeHandlerViewContainer::DidReceiveData(const char* data,
                                               int data_length) {
   view_id_ += std::string(data, data_length);

extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.h

@@ -65,6 +65,9 @@ class MimeHandlerViewContainer : public GuestViewContainer,
                         double finish_time,
                         int64_t total_encoded_data_length) override;
 
+  // GuestViewContainer overrides.
+  void OnRenderFrameDestroyed() override;
+
   // Post a JavaScript message to the guest.
   void PostMessage(v8::Isolate* isolate,
                    v8::Handle<v8::Value> message);