Deal with frame removal by content scripts

third_party/WebKit/Source/core/html/ImageDocument.cpp

Index: third_party/WebKit/Source/core/html/ImageDocument.cpp
diff --git a/third_party/WebKit/Source/core/html/ImageDocument.cpp b/third_party/WebKit/Source/core/html/ImageDocument.cpp
index ad9df679eb1a2e5c64e2c1298c0e23b10304a231..d79aac7d05bf4f8a06b54e46a9c764e3caa6e6d7 100644
--- a/third_party/WebKit/Source/core/html/ImageDocument.cpp
+++ b/third_party/WebKit/Source/core/html/ImageDocument.cpp
@@ -146,9 +146,7 @@ void ImageDocumentParser::appendBytes(const char* data, size_t length)
         document()->cachedImage()->appendData(data, length);
     }
 
-    // TODO(esprehn): These null checks on Document don't make sense, document()
-    // will ASSERT if it was null. Do these want to check isDetached() ?
-    if (document())
+    if (!isDetached())
         document()->imageUpdated();
 }
 
@@ -171,14 +169,14 @@ void ImageDocumentParser::finish()
             if (fileName.isEmpty())
                 fileName = document()->url().host();
             document()->setTitle(imageTitle(fileName, size));
+            if (isDetached())
+                return;
         }
 
         document()->imageUpdated();
     }
 
-    // TODO(esprehn): These null checks on Document don't make sense, document()
-    // will ASSERT if it was null. Do these want to check isDetached() ?
-    if (document())
+    if (!isDetached())
         document()->finishedParsing();
 }
 
@@ -207,8 +205,9 @@ void ImageDocument::createDocumentStructure(bool loadingMultipartContent)
     appendChild(rootElement);
     rootElement->insertedByParser();
 
-    if (frame())
-        frame()->loader().dispatchDocumentElementAvailable();
+    frame()->loader().dispatchDocumentElementAvailable();
+    if (isStopped())
+        return;
     // Normally, ImageDocument creates an HTMLImageElement that doesn't actually load
     // anything, and the ImageDocument routes the main resource data into the HTMLImageElement's
     // ImageResource. However, the main resource pipeline doesn't know how to handle multipart content.
@@ -226,8 +225,7 @@ void ImageDocument::createDocumentStructure(bool loadingMultipartContent)
     RefPtrWillBeRawPtr<HTMLBodyElement> body = HTMLBodyElement::create(*this);
     body->setAttribute(styleAttr, "margin: 0px;");
 
-    if (frame())
-        frame()->loader().client()->dispatchWillInsertBody();
+    frame()->loader().client()->dispatchWillInsertBody();
 
     m_imageElement = HTMLImageElement::create(*this);
     m_imageElement->setAttribute(styleAttr, "-webkit-user-select: none");
@@ -248,7 +246,11 @@ void ImageDocument::createDocumentStructure(bool loadingMultipartContent)
     }
 
     rootElement->appendChild(head);
+    if (isStopped())
+        return;
     rootElement->appendChild(body);
+    if (isStopped())
+        return;
     if (loadingMultipartContent)
         finishedParsing();
 }
@@ -416,8 +418,13 @@ void ImageDocument::windowSizeChanged(ScaleType type)
 ImageResource* ImageDocument::cachedImage()
 {
     bool loadingMultipartContent = loader() && loader()->loadingMultipartContent();
-    if (!m_imageElement)
+    if (!m_imageElement) {
         createDocumentStructure(loadingMultipartContent);
+        if (isStopped()) {
+            m_imageElement = nullptr;
+            return nullptr;
+        }
+    }
 
     return loadingMultipartContent ? nullptr : m_imageElement->cachedImage();
 }