Detach old frame on WebFrame::swap.

Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 982 matching lines @@
 }
 
 void FrameLoader::notifyIfInitialDocumentAccessed()
 {
     if (m_didAccessInitialDocumentTimer.isActive()) {
         m_didAccessInitialDocumentTimer.stop();
         didAccessInitialDocumentTimerFired(0);
     }
 }
 
-void FrameLoader::commitProvisionalLoad()
+bool FrameLoader::prepareForCommit()
 {
-    ASSERT(client()->hasWebView());
     PluginScriptForbiddenScope forbidPluginDestructorScripting;
     RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;
-    RefPtrWillBeRawPtr<LocalFrame> protect(m_frame.get());
-
-    // Check if the destination page is allowed to access the previous page's timing information.
-    if (m_frame->document()) {
-        RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::create(pdl->request().url());
-        pdl->timing().setHasSameOriginAsPreviousDocument(securityOrigin->canRequest(m_frame->document()->url()));
-    }
 
     if (m_documentLoader) {
         client()->dispatchWillClose();
         dispatchUnloadEvent();
     }
     m_frame->detachChildren();
     // The previous calls to dispatchUnloadEvent() and detachChildren() can
     // execute arbitrary script via things like unload events. If the executed
     // script intiates a new load or causes the current frame to be detached,
     // we need to abandon the current load.
     if (pdl != m_provisionalDocumentLoader)
-        return;
+        return false;
     if (m_documentLoader) {
         FrameNavigationDisabler navigationDisabler(m_frame);
         m_documentLoader->detachFromFrame();
     }
     // detachFromFrame() will abort XHRs that haven't completed, which can
     // trigger event listeners for 'abort'. These event listeners might detach
     // the frame.
     // TODO(dcheng): Investigate if this can be moved above the check that
     // m_provisionalDocumentLoader hasn't changed.
     if (!m_frame->client())
-        return;
+        return false;
     // No more events will be dispatched so detach the Document.
     if (m_frame->document())
         m_frame->document()->detach();
     m_documentLoader = m_provisionalDocumentLoader.release();
 
+    return true;
+}
+
+void FrameLoader::commitProvisionalLoad()
+{
+    ASSERT(client()->hasWebView());
+    RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;

[dcheng, 2015/06/10 19:56:29]

Do we still need this protector? JS events don't run before lines 1045-1048.

[lfg, 2015/06/10 22:43:35]

No, we don't need it. Removed.

+    RefPtrWillBeRawPtr<LocalFrame> protect(m_frame.get());
+
+    // Check if the destination page is allowed to access the previous page's timing information.
+    if (m_frame->document()) {
+        RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::create(pdl->request().url());
+        pdl->timing().setHasSameOriginAsPreviousDocument(securityOrigin->canRequest(m_frame->document()->url()));
+    }
+
+    if (!prepareForCommit())
+        return;
+
     if (isLoadingMainFrame())
         m_frame->page()->chromeClient().needTouchEvents(false);
 
     client()->transitionToCommittedForNewPage();
     m_frame->navigationScheduler().cancel();
     m_frame->editor().clearLastEditCommand();
 
     // If we are still in the process of initializing an empty document then
     // its frame is not in a consistent state for rendering, so avoid setJSStatusBarText
     // since it may cause clients to attempt to render the frame.
@@ skipping 422 matching lines @@
     // FIXME: We need a way to propagate insecure requests policy flags to
     // out-of-process frames. For now, we'll always use default behavior.
     if (!parentFrame->isLocalFrame())
         return nullptr;
 
     ASSERT(toLocalFrame(parentFrame)->document());
     return toLocalFrame(parentFrame)->document()->insecureNavigationsToUpgrade();
 }
 
 } // namespace blink