Deal with frame removal by content scripts

extensions/renderer/render_frame_observer_natives.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/render_frame_observer_natives.h"
 
 #include "base/bind.h"
 #include "base/macros.h"
 #include "base/message_loop/message_loop.h"
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "extensions/renderer/extension_frame_helper.h"
 #include "extensions/renderer/script_context.h"
 
 namespace extensions {
 
 namespace {
 
 // Deletes itself when done.
 class LoadWatcher : public content::RenderFrameObserver {
  public:
   LoadWatcher(content::RenderFrame* frame,
               const base::Callback<void(bool)>& callback)
       : content::RenderFrameObserver(frame), callback_(callback) {}
 
   void DidCreateDocumentElement() override {
-    // The callback must be run as soon as the root element is available.
-    // Running the callback may trigger DidCreateDocumentElement or
-    // DidFailProvisionalLoad, so delete this before running the callback.
-    base::Callback<void(bool)> callback = callback_;
+    // Defer the callback instead of running it now to avoid re-entrancy caused
+    // by the JavaScript callback.
+    ExtensionFrameHelper::Get(render_frame())
+        ->ScheduleAtDocumentStart(base::Bind(callback_, true));
     delete this;
-    callback.Run(true);
   }
 
   void DidFailProvisionalLoad(const blink::WebURLError& error) override {
     // Use PostTask to avoid running user scripts while handling this
     // DidFailProvisionalLoad notification.
     base::MessageLoop::current()->PostTask(FROM_HERE,
                                            base::Bind(callback_, false));
     delete this;
   }
 
@@ skipping 56 matching lines @@
     v8::Global<v8::Function> callback,
     bool succeeded) {
   v8::Isolate* isolate = context()->isolate();
   v8::HandleScope handle_scope(isolate);
   v8::Local<v8::Value> args[] = {v8::Boolean::New(isolate, succeeded)};
   context()->CallFunction(v8::Local<v8::Function>::New(isolate, callback),
                           arraysize(args), args);
 }
 
 }  // namespace extensions