Detach the globals of all frames, not just the main frame

third_party/WebKit/Source/web/WebFrame.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "public/web/WebFrame.h"
 
 #include "bindings/core/v8/WindowProxyManager.h"
 #include "core/frame/FrameHost.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/RemoteFrame.h"
 #include "core/html/HTMLFrameElementBase.h"
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "core/page/Page.h"
 #include "platform/UserGestureIndicator.h"
 #include "platform/heap/Handle.h"
 #include "public/web/WebElement.h"
+#include "public/web/WebKit.h"
 #include "public/web/WebSandboxFlags.h"
 #include "web/OpenedFrameTracker.h"
 #include "web/RemoteBridgeFrameOwner.h"
 #include "web/WebLocalFrameImpl.h"
 #include "web/WebRemoteFrameImpl.h"
 #include <algorithm>
 
 namespace blink {
 
 Frame* toCoreFrame(const WebFrame* frame)
@@ skipping 48 matching lines @@
         frame->setOpener(m_opener);
         setOpener(nullptr);
     }
     m_openedFrameTracker->transferTo(frame);
 
     FrameHost* host = oldFrame->host();
     AtomicString name = oldFrame->tree().name();
     FrameOwner* owner = oldFrame->owner();
     oldFrame->disconnectOwnerElement();
 
-    v8::HandleScope handleScope(v8::Isolate::GetCurrent());
-    HashMap<DOMWrapperWorld*, v8::Local<v8::Object>> globals;
-    oldFrame->windowProxyManager()->clearForNavigation();
-    oldFrame->windowProxyManager()->releaseGlobals(globals);
-
     // Although the Document in this frame is now unloaded, many resources
     // associated with the frame itself have not yet been freed yet.
     oldFrame->detach(FrameDetachType::Swap);
 
+    v8::HandleScope handleScope(mainThreadIsolate());
+    HashMap<DOMWrapperWorld*, v8::Local<v8::Object>> globals;
+    oldFrame->windowProxyManager()->releaseGlobals(globals);
+
     // Finally, clone the state of the current Frame into one matching
     // the type of the passed in WebFrame.
     // FIXME: This is a bit clunky; this results in pointless decrements and
     // increments of connected subframes.
     if (frame->isWebLocalFrame()) {
         LocalFrame& localFrame = *toWebLocalFrameImpl(frame)->frame();
         ASSERT(owner == localFrame.owner());
         if (owner) {
             if (owner->isLocal()) {
                 HTMLFrameOwnerElement* ownerElement = toHTMLFrameOwnerElement(owner);
@@ skipping 249 matching lines @@
     void WebFrame::traceFrames(VisitorDispatcher visitor, WebFrame* frame) { traceFramesImpl(visitor, frame); }                \
     void WebFrame::clearWeakFrames(VisitorDispatcher visitor) { clearWeakFramesImpl(visitor); }
 
 DEFINE_VISITOR_METHOD(Visitor*)
 DEFINE_VISITOR_METHOD(InlinedGlobalMarkingVisitor)
 
 #undef DEFINE_VISITOR_METHOD
 #endif
 
 } // namespace blink