Remove ResourceFetcher's access to a FrameFetchContext when detaching

Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
@@ skipping 465 matching lines @@
     , m_didAssociateFormControlsTimer(this, &Document::didAssociateFormControlsTimerFired)
     , m_hasViewportUnits(false)
     , m_styleRecalcElementCounter(0)
     , m_parserSyncPolicy(AllowAsynchronousParsing)
 {
     if (m_frame) {
         ASSERT(m_frame->page());
         provideContextFeaturesToDocumentFrom(*this, *m_frame->page());
 
         m_fetcher = m_frame->loader().documentLoader()->fetcher();
+        FrameFetchContext::provideDocumentToContext(m_fetcher->context(), this);
+    } else if (m_importsController) {
+        m_fetcher = FrameFetchContext::createContextAndFetcher(nullptr);
+        FrameFetchContext::provideDocumentToContext(m_fetcher->context(), this);
+    } else {
+        m_fetcher = ResourceFetcher::create(nullptr);
     }
 
-    if (!m_fetcher)
-        m_fetcher = FrameFetchContext::createContextAndFetcher(nullptr);
-    static_cast<FrameFetchContext&>(m_fetcher->context()).setDocument(this);
-
     // We depend on the url getting immediately set in subframes, but we
     // also depend on the url NOT getting immediately set in opened windows.
     // See fast/dom/early-frame-url.html
     // and fast/dom/location-new-window-no-crash.html, respectively.
     // FIXME: Can/should we unify this behavior?
     if (initializer.shouldSetURL())
         setURL(initializer.url());
 
     initSecurityContext(initializer);
     initDNSPrefetch();
@@ skipping 23 matching lines @@
 #endif
 }
 
 Document::~Document()
 {
     ASSERT(!layoutView());
     ASSERT(!parentTreeScope());
 #if !ENABLE(OILPAN)
     ASSERT(m_ranges.isEmpty());
     ASSERT(!hasGuardRefCount());
+    ASSERT(!m_importsController);
     // With Oilpan, either the document outlives the visibility observers
     // or the visibility observers and the document die in the same GC round.
     // When they die in the same GC round, the list of visibility observers
     // will not be empty on Document destruction.
     ASSERT(m_visibilityObservers.isEmpty());
 
     if (m_templateDocument)
         m_templateDocument->m_templateDocumentHost = nullptr; // balanced in ensureTemplateDocument().
 
     m_scriptRunner.clear();
@@ skipping 14 matching lines @@
     detachParser();
 #endif
 
     if (this == &axObjectCacheOwner())
         clearAXObjectCache();
 
 #if !ENABLE(OILPAN)
     if (m_styleSheetList)
         m_styleSheetList->detachFromDocument();
 
-    if (m_importsController)
-        HTMLImportsController::removeFrom(*this);
-
     m_timeline->detachFromDocument();
 
     // We need to destroy CSSFontSelector before destroying m_fetcher.
     m_styleEngine->detachFromDocument();
 
     if (m_elemSheet)
         m_elemSheet->clearOwnerNode();
 
-    // It's possible for multiple Documents to end up referencing the same ResourceFetcher (e.g., SVGImages
-    // load the initial empty document and the SVGDocument with the same DocumentLoader).
-    FrameFetchContext& context = static_cast<FrameFetchContext&>(m_fetcher->context());
-    if (context.document() == this)
-        context.setDocument(nullptr);
-    m_fetcher.clear();
-
     // We must call clearRareData() here since a Document class inherits TreeScope
     // as well as Node. See a comment on TreeScope.h for the reason.
     if (hasRareData())
         clearRareData();
 
     ASSERT(m_listsInvalidatedAtDocument.isEmpty());
 
     for (unsigned i = 0; i < WTF_ARRAY_LENGTH(m_nodeListCounts); ++i)
         ASSERT(!m_nodeListCounts[i]);
 
@@ skipping 19 matching lines @@
     m_titleElement = nullptr;
     m_documentElement = nullptr;
     m_contextFeatures = ContextFeatures::defaultSwitch();
     m_userActionElements.documentDidRemoveLastRef();
     m_associatedFormControls.clear();
 
     detachParser();
 
     m_registrationContext.clear();
 
-    if (m_importsController)
-        HTMLImportsController::removeFrom(*this);
-
     // removeDetachedChildren() doesn't always unregister IDs,
     // so tear down scope information upfront to avoid having stale references in the map.
     destroyTreeScopeData();
 
     removeDetachedChildren();
 
     // removeDetachedChildren() can access FormController.
     m_formController.clear();
 
     m_markers->clear();
@@ skipping 188 matching lines @@
 {
     if (!m_customElementMicrotaskRunQueue)
         m_customElementMicrotaskRunQueue = CustomElementMicrotaskRunQueue::create();
     return m_customElementMicrotaskRunQueue.get();
 }
 
 void Document::setImportsController(HTMLImportsController* controller)
 {
     ASSERT(!m_importsController || !controller);
     m_importsController = controller;
+    if (!m_importsController)
+        m_fetcher->clearContext();
 }
 
 HTMLImportLoader* Document::importLoader() const
 {
     if (!m_importsController)
         return 0;
     return m_importsController->loaderFor(*this);
 }
 
 bool Document::haveImportsLoaded() const
@@ skipping 1306 matching lines @@
     if (this == &axObjectCacheOwner())
         clearAXObjectCache();
 
     m_layoutView = nullptr;
     ContainerNode::detach(context);
 
     styleEngine().didDetach();
 
     frameHost()->eventHandlerRegistry().documentDetached(*this);
 
+    // If this Document is associated with a live DocumentLoader, the
+    // DocumentLoader will take care of clearing the FetchContext. Deferring
+    // to the DocumentLoader when possible also prevents prematurely clearing
+    // the context in the case where multiple Documents end up associated with
+    // a single DocumentLoader (e.g., navigating to a javascript: url).
+    if (!loader())
+        m_fetcher->clearContext();
+    // If this document is the master for an HTMLImportsController, sever that
+    // relationship. This ensures that we don't leave import loads in flight,
+    // thinking they should have access to a valid frame when they don't.
+    if (m_importsController)
+        HTMLImportsController::removeFrom(*this);
+
     // This is required, as our LocalFrame might delete itself as soon as it detaches
     // us. However, this violates Node::detach() semantics, as it's never
     // possible to re-attach. Eventually Document::detach() should be renamed,
     // or this setting of the frame to 0 could be made explicit in each of the
     // callers of Document::detach().
     m_frame = nullptr;
 
     if (m_mediaQueryMatcher)
         m_mediaQueryMatcher->documentDetached();
 
@@ skipping 3584 matching lines @@
 #ifndef NDEBUG
 using namespace blink;
 void showLiveDocumentInstances()
 {
     WeakDocumentSet& set = liveDocumentSet();
     fprintf(stderr, "There are %u documents currently alive:\n", set.size());
     for (Document* document : set)
         fprintf(stderr, "- Document %p URL: %s\n", document, document->url().string().utf8().data());
 }
 #endif