From afca3ff9657ae08d4ead68ee23d0a04fc5042465 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Wed, 25 Jan 2023 15:51:01 +0100
Subject: [PATCH] chore: call `ListenerDestroyed()` in
 `FileSelectHelper::RunFileChooserEnd()` (#37006)

chore: call ListenerDestroyed() in FileSelectHelper::RunFileChooserEnd()
---
 shell/browser/file_select_helper.cc | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/shell/browser/file_select_helper.cc b/shell/browser/file_select_helper.cc
index 69c8197ae45..01a85b6ff34 100644
--- a/shell/browser/file_select_helper.cc
+++ b/shell/browser/file_select_helper.cc
@@ -180,7 +180,7 @@ void FileSelectHelper::OnListDone(int error) {
   std::unique_ptr<ActiveDirectoryEnumeration> entry =
       std::move(directory_enumeration_);
   if (error) {
-    FileSelectionCanceled(NULL);
+    FileSelectionCanceled(nullptr);
     return;
   }
 
@@ -487,6 +487,11 @@ void FileSelectHelper::RunFileChooserEnd() {
     listener_->FileSelectionCanceled();
   render_frame_host_ = nullptr;
   web_contents_ = nullptr;
+  // If the dialog was actually opened, dispose of our reference.
+  if (select_file_dialog_) {
+    select_file_dialog_->ListenerDestroyed();
+    select_file_dialog_.reset();
+  }
   Release();
 }
 
@@ -525,8 +530,6 @@ void FileSelectHelper::RenderWidgetHostDestroyed(
 void FileSelectHelper::RenderFrameHostChanged(
     content::RenderFrameHost* old_host,
     content::RenderFrameHost* new_host) {
-  if (!render_frame_host_)
-    return;
   // The |old_host| and its children are now pending deletion. Do not give them
   // file access past this point.
   for (content::RenderFrameHost* host = render_frame_host_; host;