Detach old frame on WebFrame::swap.

Source/core/loader/FrameLoader.cpp

Index: Source/core/loader/FrameLoader.cpp
diff --git a/Source/core/loader/FrameLoader.cpp b/Source/core/loader/FrameLoader.cpp
index 95e6a1f13e495bad5e53f3d61d64e055a17dcf4f..3dc74a1a80f076eb9b3506582bb36517ee3cdab6 100644
--- a/Source/core/loader/FrameLoader.cpp
+++ b/Source/core/loader/FrameLoader.cpp
@@ -1000,18 +1000,10 @@ void FrameLoader::notifyIfInitialDocumentAccessed()
     }
 }
 
-void FrameLoader::commitProvisionalLoad()
+bool FrameLoader::prepareForCommit()
 {
-    ASSERT(client()->hasWebView());
     PluginScriptForbiddenScope forbidPluginDestructorScripting;
     RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;
-    RefPtrWillBeRawPtr<LocalFrame> protect(m_frame.get());
-
-    // Check if the destination page is allowed to access the previous page's timing information.
-    if (m_frame->document()) {
-        RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::create(pdl->request().url());
-        pdl->timing().setHasSameOriginAsPreviousDocument(securityOrigin->canRequest(m_frame->document()->url()));
-    }
 
     if (m_documentLoader) {
         client()->dispatchWillClose();
@@ -1023,7 +1015,7 @@ void FrameLoader::commitProvisionalLoad()
     // script intiates a new load or causes the current frame to be detached,
     // we need to abandon the current load.
     if (pdl != m_provisionalDocumentLoader)
-        return;
+        return false;
     if (m_documentLoader) {
         FrameNavigationDisabler navigationDisabler(m_frame);
         m_documentLoader->detachFromFrame();
@@ -1034,12 +1026,30 @@ void FrameLoader::commitProvisionalLoad()
     // TODO(dcheng): Investigate if this can be moved above the check that
     // m_provisionalDocumentLoader hasn't changed.
     if (!m_frame->client())
-        return;
+        return false;
     // No more events will be dispatched so detach the Document.
     if (m_frame->document())
         m_frame->document()->detach();
     m_documentLoader = m_provisionalDocumentLoader.release();
 
+    return true;
+}
+
+void FrameLoader::commitProvisionalLoad()
+{
+    ASSERT(client()->hasWebView());
+    RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;

[dcheng, 2015/06/10 19:56:29]

Do we still need this protector? JS events don't run before lines 1045-1048.

[lfg, 2015/06/10 22:43:35]

No, we don't need it. Removed.

+    RefPtrWillBeRawPtr<LocalFrame> protect(m_frame.get());
+
+    // Check if the destination page is allowed to access the previous page's timing information.
+    if (m_frame->document()) {
+        RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::create(pdl->request().url());
+        pdl->timing().setHasSameOriginAsPreviousDocument(securityOrigin->canRequest(m_frame->document()->url()));
+    }
+
+    if (!prepareForCommit())
+        return;
+
     if (isLoadingMainFrame())
         m_frame->page()->chromeClient().needTouchEvents(false);