Check frame detach on bind.

When the frame is detached, the receivers are reset. This makes it
possible for BindToReceiver and its variants to be called while the
frame is detached. This is an issue because the frame scheduler also
gets reset on detach so when we try to call 'GetTaskRunner'
(which invokes a method on the frame scheduler) it can crash.

To prevent bindings from occurring when there is no execution context,
this CL checks whether the frame is detached before binding a pending
receiver.

Bug: 1103594
Change-Id: I8179ee81b5ca992f88dbb627be1fec5eeeb0a5ae
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2303777Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Ken Rockot <rockot@google.com>
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Commit-Queue: Katie Dillon <kdillon@chromium.org>
Cr-Commit-Position: refs/heads/master@{#802952}

third_party/blink/renderer/core/frame/local_frame.cc

@@ -3120,6 +3120,9 @@ void LocalFrame::BindToReceiver(
     blink::LocalFrame* frame,
     mojo::PendingAssociatedReceiver<mojom::blink::LocalFrame> receiver) {
   DCHECK(frame);
+  if (frame->IsDetached())
+    return;
+
   frame->receiver_.Bind(
       std::move(receiver),
       frame->GetTaskRunner(blink::TaskType::kInternalDefault));
@@ -3129,6 +3132,9 @@ void LocalFrame::BindToMainFrameReceiver(
     blink::LocalFrame* frame,
     mojo::PendingAssociatedReceiver<mojom::blink::LocalMainFrame> receiver) {
   DCHECK(frame);
+  if (frame->IsDetached())
+    return;
+
   frame->main_frame_receiver_.Bind(
       std::move(receiver),
       frame->GetTaskRunner(blink::TaskType::kInternalDefault));
@@ -3136,6 +3142,9 @@ void LocalFrame::BindToMainFrameReceiver(
 
 void LocalFrame::BindToHighPriorityReceiver(
     mojo::PendingReceiver<mojom::blink::HighPriorityLocalFrame> receiver) {
+  if (IsDetached())
+    return;
+
   high_priority_frame_receiver_.Bind(
       std::move(receiver),
       GetTaskRunner(blink::TaskType::kInternalHighPriorityLocalFrame));