Fix crash when an onorientationchange event detaches an iframe.

Fix crash when an onorientationchange event detaches an iframe.

Collect all of the frames that need onorientationchange before firing any of the events. If a frame gets detached, frame->localDOMWindow()->frame() will be null, and the recursive invocation will crash.

BUG=492432, 466485
TEST=WebFrameTest.OrientationFrameDetach

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=196895

[Nate Chapin, 2015-06-10 16:32:07]

japhet@chromium.org changed reviewers:
+ dcheng@chromium.org

[dcheng, 2015-06-10 17:46:13]

https://codereview.chromium.org/1172603004/diff/20001/Source/core/frame/Local...
File Source/core/frame/LocalDOMWindow.cpp (right):

https://codereview.chromium.org/1172603004/diff/20001/Source/core/frame/Local...
Source/core/frame/LocalDOMWindow.cpp:533:
toLocalFrame(frames[i].get())->localDOMWindow()->dispatchEvent(Event::create(EventTypeNames::orientationchange));
Out of curiosity, what happens when we try to dispatch an event on a detached
window?

[Nate Chapin, 2015-06-10 18:13:46]

On 2015/06/10 17:46:13, dcheng wrote:
>
https://codereview.chromium.org/1172603004/diff/20001/Source/core/frame/Local...
> File Source/core/frame/LocalDOMWindow.cpp (right):
> 
>
https://codereview.chromium.org/1172603004/diff/20001/Source/core/frame/Local...
> Source/core/frame/LocalDOMWindow.cpp:533:
>
toLocalFrame(frames[i].get())->localDOMWindow()->dispatchEvent(Event::create(EventTypeNames::orientationchange));
> Out of curiosity, what happens when we try to dispatch an event on a detached
> window?

I don't know off the top of my head, other than it's what we do currently :)

[dcheng, 2015-06-10 20:04:16]

lgtm

It's going to be interesting once mlamouri@ starts plumbing resize notifications
through WebFrameWidget... but I guess we can cross that road when we get there.

[Nate Chapin, 2015-06-10 20:05:53]

The CQ bit was checked by japhet@chromium.org

[commit-bot: I haz the power, 2015-06-10 20:06:16]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1172603004/20001

[commit-bot: I haz the power, 2015-06-10 20:09:10]

Committed patchset #2 (id:20001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=196895

[esprehn, 2015-06-11 01:57:11]

esprehn@chromium.org changed reviewers:
+ esprehn@chromium.org

[esprehn, 2015-06-11 01:57:12]

https://codereview.chromium.org/1172603004/diff/20001/Source/core/frame/Local...
File Source/core/frame/LocalDOMWindow.cpp (right):

https://codereview.chromium.org/1172603004/diff/20001/Source/core/frame/Local...
Source/core/frame/LocalDOMWindow.cpp:533:
toLocalFrame(frames[i].get())->localDOMWindow()->dispatchEvent(Event::create(EventTypeNames::orientationchange));
On 2015/06/10 at 17:46:12, dcheng wrote:
> Out of curiosity, what happens when we try to dispatch an event on a detached
window?

That works fine, for example in script I can do:

var iframe = document.createElement("iframe");
iframe.onload = function() {
  var contentWindow = iframe.contentWindow;
  iframe.remove(); // detached here.
  contentWindow.dispatchEvent(new Event("test"));
};
document.body.appendChild(iframe);