Fix crash when an onorientationchange event detaches an iframe.

Source/core/frame/LocalDOMWindow.cpp

Index: Source/core/frame/LocalDOMWindow.cpp
diff --git a/Source/core/frame/LocalDOMWindow.cpp b/Source/core/frame/LocalDOMWindow.cpp
index 97179dffc684d668a491d62c2e04e7a5c7423c7c..77a5df26a54ab0fd2a0f7b51bbdafcb58753e5c6 100644
--- a/Source/core/frame/LocalDOMWindow.cpp
+++ b/Source/core/frame/LocalDOMWindow.cpp
@@ -518,21 +518,19 @@ void LocalDOMWindow::reset()
 void LocalDOMWindow::sendOrientationChangeEvent()
 {
     ASSERT(RuntimeEnabledFeatures::orientationEventEnabled());
+    ASSERT(frame()->isMainFrame());
 
-    // Before dispatching the event, build a list of the child frames to
-    // also send the event to, to mitigate side effects from event handlers
+    // Before dispatching the event, build a list of all frames in the page
+    // to send the event to, to mitigate side effects from event handlers
     // potentially interfering with others.
-    WillBeHeapVector<RefPtrWillBeMember<Frame>> childFrames;
-    for (Frame* child = frame()->tree().firstChild(); child; child = child->tree().nextSibling()) {
-        childFrames.append(child);
-    }
-
-    dispatchEvent(Event::create(EventTypeNames::orientationchange));
+    WillBeHeapVector<RefPtrWillBeMember<Frame>> frames;
+    for (Frame* f = frame(); f; f = f->tree().traverseNext())
+        frames.append(f);
 
-    for (size_t i = 0; i < childFrames.size(); ++i) {
-        if (!childFrames[i]->isLocalFrame())
+    for (size_t i = 0; i < frames.size(); ++i) {
+        if (!frames[i]->isLocalFrame())
             continue;
-        toLocalFrame(childFrames[i].get())->localDOMWindow()->sendOrientationChangeEvent();
+        toLocalFrame(frames[i].get())->localDOMWindow()->dispatchEvent(Event::create(EventTypeNames::orientationchange));

[dcheng, 2015/06/10 17:46:12]

Out of curiosity, what happens when we try to dispatch an event on a detached
window?

[esprehn, 2015/06/11 01:57:12]

That works fine, for example in script I can do:

var iframe = document.createElement("iframe");
iframe.onload = function() {
  var contentWindow = iframe.contentWindow;
  iframe.remove(); // detached here.
  contentWindow.dispatchEvent(new Event("test"));
};
document.body.appendChild(iframe);

     }
 }