ContentCapture: Fix a sender crash in corner case

Bug: 1127082
Change-Id: I64ea0a51b703c8094e24fb473189c93f47b6217f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2406178
Commit-Queue: Tao Bai <michaelbai@chromium.org>
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#806226}

components/content_capture/renderer/content_capture_sender.cc

@@ -62,11 +62,22 @@ void ContentCaptureSender::DidRemoveContent(blink::WebVector<int64_t> data) {
 }
 
 void ContentCaptureSender::StartCapture() {
-  render_frame()->GetWebFrame()->SetContentCaptureClient(this);
+  // The render_frame() is invalid after RenderFrameObserver::RenderFrameGone()
+  // called.
+  // Refer to crbug.com/1127082.
+  if (auto* rf = render_frame()) {
+    if (auto* web_frame = rf->GetWebFrame()) {
+      web_frame->SetContentCaptureClient(this);
+    }
+  }
 }
 
 void ContentCaptureSender::StopCapture() {
-  render_frame()->GetWebFrame()->SetContentCaptureClient(nullptr);
+  if (auto* rf = render_frame()) {
+    if (auto* web_frame = rf->GetWebFrame()) {
+      web_frame->SetContentCaptureClient(nullptr);
+    }
+  }
 }
 
 void ContentCaptureSender::OnDestruct() {