A Push crash was fixed in https://codereview.chromium.org/1355513003 by adding a work-around solution to RenderFrameHostImpl to check if the frame is attached to the frame tree and returning early if it is not. I have to refactor this work-around in a CL right now and ideally it could be removed at some point, if the root cause can be addressed (or if it already has been). We shouldn't call methods on detached RenderFrameHosts, in general.