Code: void RenderWidgetHostImpl::Destroy(bool also_delete) {
  DCHECK(!destroyed_);
  destroyed_ = true;

  NotificationService::current()->Notify(
      NOTIFICATION_RENDER_WIDGET_HOST_DESTROYED, Source<RenderWidgetHost>(this),
      NotificationService::NoDetails());

  if (view_) {
    view_->Destroy();
    view_.reset();
  }

  process_->RemoveRoute(routing_id_);
  g_routing_id_widget_map.Get().erase(
      RenderWidgetHostID(process_->GetID(), routing_id_));

   if (delegate_)
     delegate_->RenderWidgetDeleted(this);
 
  if (also_delete)
     delete this;
 }

Vulnerability Type: DoS 
CWE ID: 
Summary: Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in content/browser/renderer_host/render_widget_host_impl.cc in the Navigation implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Commit Message: Check that RWHI isn't deleted manually while owned by a scoped_ptr in RVHI

BUG=590284

Review URL: https://codereview.chromium.org/1747183002

Cr-Commit-Position: refs/heads/master@{#378844}