RenderFrameHostManager::current_frame_host() is expected not to be null.
This is a bit hard to guarantee, a lot of code can run inside its destructor:
#1 RenderFrameHostManager::~RenderFrameHostManager()
#2 RenderFrameHostImpl::~RenderFrameHostImpl()
#3 WebContentsImpl::RenderFrameDeleted()
#4 WebContentsObserver::RenderFrameDeleted() (38 override excluding tests)
This is a bit unsafe. A lot of helper function assumes they can always dereference current_frame_host().
We can have rfh->frame_tree_node()->current_frame_host() == nullptr, even when rfh is the current render frame host.
============
Note: I tried several things:
1) in std::unique_ptr, exchanging ~RenderFrameHostImpl and releasing the ptr, so that current_frame_host() is still available while destructing it...
.------------------------------------------------------
| RenderFrameHostManager::~RenderFrameHostManager() {
| [...]
| delete render_frame_.get()
| render_frame_.release()
| }
`------------------------------------------------------
...but I think there is risk of the destructor being called inside itself.
2) Calling the observer earlier, before releasing current_frame_host().
https://chromium-review.googlesource.com/c/chromium/src/+/1206812
but it breaks a lot of tests.
Comment 1 by bugdroid1@chromium.org
, Sep 17