Fix crash when an onorientationchange event detaches an iframe.

Source/core/frame/LocalDOMWindow.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 500 matching lines @@
 #endif
 
     resetLocation();
 
     LocalDOMWindow::notifyContextDestroyed();
 }
 
 void LocalDOMWindow::sendOrientationChangeEvent()
 {
     ASSERT(RuntimeEnabledFeatures::orientationEventEnabled());
+    ASSERT(frame()->isMainFrame());
 
-    // Before dispatching the event, build a list of the child frames to
-    // also send the event to, to mitigate side effects from event handlers
+    // Before dispatching the event, build a list of all frames in the page
+    // to send the event to, to mitigate side effects from event handlers
     // potentially interfering with others.
-    WillBeHeapVector<RefPtrWillBeMember<Frame>> childFrames;
-    for (Frame* child = frame()->tree().firstChild(); child; child = child->tree().nextSibling()) {
-        childFrames.append(child);
-    }
+    WillBeHeapVector<RefPtrWillBeMember<Frame>> frames;
+    for (Frame* f = frame(); f; f = f->tree().traverseNext())
+        frames.append(f);
 
-    dispatchEvent(Event::create(EventTypeNames::orientationchange));
-
-    for (size_t i = 0; i < childFrames.size(); ++i) {
-        if (!childFrames[i]->isLocalFrame())
+    for (size_t i = 0; i < frames.size(); ++i) {
+        if (!frames[i]->isLocalFrame())
             continue;
-        toLocalFrame(childFrames[i].get())->localDOMWindow()->sendOrientationChangeEvent();
+        toLocalFrame(frames[i].get())->localDOMWindow()->dispatchEvent(Event::create(EventTypeNames::orientationchange));

[dcheng, 2015/06/10 17:46:12]

Out of curiosity, what happens when we try to dispatch an event on a detached
window?

[esprehn, 2015/06/11 01:57:12]

That works fine, for example in script I can do:

var iframe = document.createElement("iframe");
iframe.onload = function() {
  var contentWindow = iframe.contentWindow;
  iframe.remove(); // detached here.
  contentWindow.dispatchEvent(new Event("test"));
};
document.body.appendChild(iframe);

     }
 }
 
 int LocalDOMWindow::orientation() const
 {
     ASSERT(RuntimeEnabledFeatures::orientationEventEnabled());
 
     if (!frame() || !frame()->host())
         return 0;
 
@@ skipping 967 matching lines @@
     DOMWindow::trace(visitor);
     DOMWindowLifecycleNotifier::trace(visitor);
 }
 
 LocalFrame* LocalDOMWindow::frame() const
 {
     return m_frameObserver->frame();
 }
 
 } // namespace blink