Detach old frame on WebFrame::swap.

Source/core/loader/FrameLoader.cpp

Index: Source/core/loader/FrameLoader.cpp
diff --git a/Source/core/loader/FrameLoader.cpp b/Source/core/loader/FrameLoader.cpp
index f37d7a4ab0bbf399a4e53e16cd53daaa59b91427..e432768919d7512cfd1ed329f0f23ae1fe8fe67f 100644
--- a/Source/core/loader/FrameLoader.cpp
+++ b/Source/core/loader/FrameLoader.cpp
@@ -956,17 +956,9 @@ void FrameLoader::notifyIfInitialDocumentAccessed()
     }
 }
 
-void FrameLoader::commitProvisionalLoad()
+bool FrameLoader::prepareForCommit()
 {
-    ASSERT(client()->hasWebView());
     RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;
-    RefPtrWillBeRawPtr<LocalFrame> protect(m_frame.get());
-
-    // Check if the destination page is allowed to access the previous page's timing information.
-    if (m_frame->document()) {
-        RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::create(pdl->request().url());
-        pdl->timing().setHasSameOriginAsPreviousDocument(securityOrigin->canRequest(m_frame->document()->url()));
-    }
 
     if (m_documentLoader) {
         client()->dispatchWillClose();
@@ -978,7 +970,7 @@ void FrameLoader::commitProvisionalLoad()
     // script intiates a new load or causes the current frame to be detached,
     // we need to abandon the current load.
     if (pdl != m_provisionalDocumentLoader)
-        return;
+        return false;
     if (m_documentLoader)
         m_documentLoader->detachFromFrame();
     // detachFromFrame() will abort XHRs that haven't completed, which can
@@ -987,12 +979,30 @@ void FrameLoader::commitProvisionalLoad()
     // TODO(dcheng): Investigate if this can be moved above the check that
     // m_provisionalDocumentLoader hasn't changed.
     if (!m_frame->client())
-        return;
+        return false;
     // No more events will be dispatched so detach the Document.
     if (m_frame->document())
         m_frame->document()->detach();
     m_documentLoader = m_provisionalDocumentLoader.release();

[dcheng, 2015/06/08 19:34:42]

Is it actually safe to assume that m_provisionalDocumentLoader will always be
null here in the detach case? Or we do just say that it doesn't matter, because
we're about to really detach the frame shortly afterwards anyway?

[lfg, 2015/06/10 18:41:28]

It doesn't matter, since the oldFrame is being detached no matter what when we
get here.

 
+    return true;
+}
+
+void FrameLoader::commitProvisionalLoad()
+{
+    ASSERT(client()->hasWebView());
+    RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;
+    RefPtrWillBeRawPtr<LocalFrame> protect(m_frame.get());
+
+    // Check if the destination page is allowed to access the previous page's timing information.
+    if (m_frame->document()) {
+        RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::create(pdl->request().url());
+        pdl->timing().setHasSameOriginAsPreviousDocument(securityOrigin->canRequest(m_frame->document()->url()));
+    }
+
+    if (!prepareForCommit())
+        return;
+
     if (isLoadingMainFrame())
         m_frame->page()->chromeClient().needTouchEvents(false);