Oilpan: always limit persisted plugin disposal to PluginViews instances.

third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp b/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
index 8f6b0c971926021cadefbd87bfb8ef19a226dbf8..d88821c6a6080cfc99dac52c134dc296193ca868 100644
--- a/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
@@ -94,7 +94,8 @@ DEFINE_TRACE(HTMLPlugInElement)
 void HTMLPlugInElement::disconnectContentFrame()
 {
     if (m_persistedPluginWidget) {
-        m_persistedPluginWidget->dispose();
+        if (m_persistedPluginWidget->isPluginView())
+            m_persistedPluginWidget->dispose();

[dcheng, 2015/12/11 07:47:09]

Is the only other possible case here that m_persistedPluginWidget->isFrameView()
is true?

In that case, it's safe to skip it here because it gets cleared as part of
detaching the actual frame, right>

[sof, 2015/12/11 08:01:18]

Yes, I think it is safe to do the disposal unconditionally for this code path. I
added the check to be consistent about only calling dispose() for PluginViews
over persisted widgets.

[dcheng, 2015/12/11 08:11:22]

Let's add an else { ASSERT(m_persistedPluginWidget->isFrameView()) } then.

         m_persistedPluginWidget = nullptr;
     }
     HTMLFrameOwnerElement::disconnectContentFrame();
@@ -114,7 +115,7 @@ void HTMLPlugInElement::setPersistedPluginWidget(Widget* widget)
 #if ENABLE(OILPAN)
     unregisterAsRenderlessIfNeeded();
     registerAsRenderless(widget);
-    if (m_persistedPluginWidget) {
+    if (m_persistedPluginWidget && m_persistedPluginWidget->isPluginView()) {

[dcheng, 2015/12/11 08:11:22]

Ditto, let's split this so we can have an explicit ASSERT.

         m_persistedPluginWidget->hide();
         m_persistedPluginWidget->dispose();
     }