Deal with frame removal by content scripts

third_party/WebKit/Source/core/html/PluginDocument.cpp

 /*
  * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 75 matching lines @@
         return;
 
     // FIXME: Why does this check settings?
     if (!frame->settings() || !frame->loader().allowPlugins(NotAboutToInstantiatePlugin))
         return;
 
     RefPtrWillBeRawPtr<HTMLHtmlElement> rootElement = HTMLHtmlElement::create(*document());
     rootElement->insertedByParser();
     document()->appendChild(rootElement);
     frame->loader().dispatchDocumentElementAvailable();
+    if (isStopped())
+        return;
 
     RefPtrWillBeRawPtr<HTMLBodyElement> body = HTMLBodyElement::create(*document());
     body->setAttribute(styleAttr, "background-color: rgb(38,38,38); height: 100%; width: 100%; overflow: hidden; margin: 0");
     rootElement->appendChild(body);
+    if (isStopped())

[esprehn, 2016/02/17 01:43:47]

huh?

+        return;
 
     m_embedElement = HTMLEmbedElement::create(*document());
     m_embedElement->setAttribute(widthAttr, "100%");
     m_embedElement->setAttribute(heightAttr, "100%");
     m_embedElement->setAttribute(nameAttr, "plugin");
     m_embedElement->setAttribute(idAttr, "plugin");
     m_embedElement->setAttribute(srcAttr, AtomicString(document()->url().string()));
     m_embedElement->setAttribute(typeAttr, document()->loader()->mimeType());
     body->appendChild(m_embedElement);
+    if (isStopped())

[esprehn, 2016/02/17 01:43:47]

how does inserting the body run script internally?

+        return;
 
     toPluginDocument(document())->setPluginNode(m_embedElement.get());
 
     document()->updateLayout();
 
     // We need the plugin to load synchronously so we can get the PluginView
     // below so flush the layout tasks now instead of waiting on the timer.
     frame->view()->flushAnyPendingPostLayoutTasks();
     // Focus the plugin here, as the line above is where the plugin is created.
-    if (frame->isMainFrame())
+    if (frame->isMainFrame()) {
         m_embedElement->focus();
+        if (isStopped())

[esprehn, 2016/02/17 01:43:47]

huh? What happens inside focus?

[robwu, 2016/02/22 00:15:02]

It synchronously dispatches the focus event. A potentially untrusted focus
listener could detach the frame in the focus handler.

+            return;
+    }
 
     if (PluginView* view = pluginView())
         view->didReceiveResponse(document()->loader()->response());
 }
 
 void PluginDocumentParser::appendBytes(const char* data, size_t length)
 {
-    if (!m_embedElement)
+    if (!m_embedElement) {
         createDocumentStructure();
+        if (isStopped())
+            return;
+    }
 
     if (!length)
         return;
     if (PluginView* view = pluginView())
         view->didReceiveData(data, length);
 }
 
 void PluginDocumentParser::finish()
 {
     m_embedElement = nullptr;
@@ skipping 42 matching lines @@
     HTMLDocument::detach(context);
 }
 
 DEFINE_TRACE(PluginDocument)
 {
     visitor->trace(m_pluginNode);
     HTMLDocument::trace(visitor);
 }
 
 } // namespace blink