Simplify WindowProxy handoff in WebFrame::swap().

Source/web/WebFrame.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "public/web/WebFrame.h"
 
 #include "bindings/core/v8/WindowProxyManager.h"
 #include "core/frame/FrameHost.h"
 #include "core/frame/FrameView.h"
@@ skipping 26 matching lines @@
 
 bool WebFrame::swap(WebFrame* frame)
 {
     using std::swap;
     RefPtrWillBeRawPtr<Frame> oldFrame = toCoreFrame(this);
 #if !ENABLE(OILPAN)
     RefPtrWillBeRawPtr<WebLocalFrameImpl> protectWebLocalFrame = isWebLocalFrame() ? toWebLocalFrameImpl(this) : nullptr;
     RefPtrWillBeRawPtr<WebRemoteFrameImpl> protectWebRemoteFrame = isWebRemoteFrame() ? toWebRemoteFrameImpl(this) : nullptr;
 #endif
 
-    // If the frame has been detached during detaching by any JS code, we should
-    // cancel the swap.
+    // Unload the current Document in this frame: this calls unload handlers,
+    // detaches child frames, etc. Since this runs script, make sure this frame
+    // wasn't detached before continuing with the swap.
     // FIXME: There is no unit test for this condition, so one needs to be
     // written.
     if (!oldFrame->prepareForCommit())
         return false;
 
-    FrameOwner* owner = oldFrame->owner();
-    FrameHost* host = oldFrame->host();
-
-    // Frame::detach will call clearForClose(), we need to call
-    // clearForNavigate() before detaching.
-    oldFrame->prepareSwapFrom(oldFrame.get());
-
-    oldFrame->detach(FrameDetachType::Swap);
-
     if (m_parent) {
         if (m_parent->m_firstChild == this)
             m_parent->m_firstChild = frame;
         if (m_parent->m_lastChild == this)
             m_parent->m_lastChild = frame;
         // FIXME: This is due to the fact that the |frame| may be a provisional
         // local frame, because we don't know if the navigation will result in
         // an actual page or something else, like a download. The PlzNavigate
         // project will remove the need for provisional local frames.
         frame->m_parent = m_parent;
-        m_parent = nullptr;
     }
 
     if (m_previousSibling) {
         m_previousSibling->m_nextSibling = frame;
         swap(m_previousSibling, frame->m_previousSibling);
     }
     if (m_nextSibling) {
         m_nextSibling->m_previousSibling = frame;
         swap(m_nextSibling, frame->m_nextSibling);
     }
 
     if (m_opener) {
         m_opener->m_openedFrameTracker->remove(this);
         m_opener->m_openedFrameTracker->add(frame);
         swap(m_opener, frame->m_opener);
     }
     if (!m_openedFrameTracker->isEmpty()) {
         m_openedFrameTracker->updateOpener(frame);
         frame->m_openedFrameTracker.reset(m_openedFrameTracker.release());
     }
 
     // Finally, clone the state of the current Frame into one matching
     // the type of the passed in WebFrame.
     // FIXME: This is a bit clunky; this results in pointless decrements and
     // increments of connected subframes.
+    FrameOwner* owner = oldFrame->owner();
+    oldFrame->disconnectOwnerElement();
     if (frame->isWebLocalFrame()) {
         LocalFrame& localFrame = *toWebLocalFrameImpl(frame)->frame();
         ASSERT(owner == localFrame.owner());
         if (owner) {
             if (owner->isLocal()) {
                 HTMLFrameOwnerElement* ownerElement = toHTMLFrameOwnerElement(owner);
                 ownerElement->setContentFrame(localFrame);
                 ownerElement->setWidget(localFrame.view());
             } else {
                 toRemoteBridgeFrameOwner(owner)->setContentFrame(toWebLocalFrameImpl(frame));
             }
         } else {
             localFrame.page()->setMainFrame(&localFrame);
         }
     } else {
-        toWebRemoteFrameImpl(frame)->initializeCoreFrame(host, owner, oldFrame->tree().name());
+        toWebRemoteFrameImpl(frame)->initializeCoreFrame(oldFrame->host(), owner, oldFrame->tree().name());
     }
     toCoreFrame(frame)->finishSwapFrom(oldFrame.get());
 
+    // Although the Document in this frame is now unloaded, many resources
+    // associated with the frame itself have not yet been freed yet.
+    oldFrame->detach(FrameDetachType::Swap);
+    m_parent = nullptr;
+
     return true;
 }
 
 void WebFrame::detach()
 {
     toCoreFrame(this)->detach(FrameDetachType::Remove);
 }
 
 WebSecurityOrigin WebFrame::securityOrigin() const
 {
@@ skipping 223 matching lines @@
     void WebFrame::traceFrames(VisitorDispatcher visitor, WebFrame* frame) { traceFramesImpl(visitor, frame); }                \
     void WebFrame::clearWeakFrames(VisitorDispatcher visitor) { clearWeakFramesImpl(visitor); }
 
 DEFINE_VISITOR_METHOD(Visitor*)
 DEFINE_VISITOR_METHOD(InlinedGlobalMarkingVisitor)
 
 #undef DEFINE_VISITOR_METHOD
 #endif
 
 } // namespace blink