Deal with frame removal by content scripts

third_party/WebKit/Source/core/html/PluginDocument.cpp

Index: third_party/WebKit/Source/core/html/PluginDocument.cpp
diff --git a/third_party/WebKit/Source/core/html/PluginDocument.cpp b/third_party/WebKit/Source/core/html/PluginDocument.cpp
index 9e4f57c69a07dcead5179fea28ec3b7ae88991ac..74219c82e09df539083edf9daff2953a521e9349 100644
--- a/third_party/WebKit/Source/core/html/PluginDocument.cpp
+++ b/third_party/WebKit/Source/core/html/PluginDocument.cpp
@@ -93,10 +93,14 @@ void PluginDocumentParser::createDocumentStructure()
     rootElement->insertedByParser();
     document()->appendChild(rootElement);
     frame->loader().dispatchDocumentElementAvailable();
+    if (isStopped())
+        return;
 
     RefPtrWillBeRawPtr<HTMLBodyElement> body = HTMLBodyElement::create(*document());
     body->setAttribute(styleAttr, "background-color: rgb(38,38,38); height: 100%; width: 100%; overflow: hidden; margin: 0");
     rootElement->appendChild(body);
+    if (isStopped())

[esprehn, 2016/02/17 01:43:47]

huh?

+        return;
 
     m_embedElement = HTMLEmbedElement::create(*document());
     m_embedElement->setAttribute(widthAttr, "100%");
@@ -106,6 +110,8 @@ void PluginDocumentParser::createDocumentStructure()
     m_embedElement->setAttribute(srcAttr, AtomicString(document()->url().string()));
     m_embedElement->setAttribute(typeAttr, document()->loader()->mimeType());
     body->appendChild(m_embedElement);
+    if (isStopped())

[esprehn, 2016/02/17 01:43:47]

how does inserting the body run script internally?

+        return;
 
     toPluginDocument(document())->setPluginNode(m_embedElement.get());
 
@@ -115,8 +121,11 @@ void PluginDocumentParser::createDocumentStructure()
     // below so flush the layout tasks now instead of waiting on the timer.
     frame->view()->flushAnyPendingPostLayoutTasks();
     // Focus the plugin here, as the line above is where the plugin is created.
-    if (frame->isMainFrame())
+    if (frame->isMainFrame()) {
         m_embedElement->focus();
+        if (isStopped())

[esprehn, 2016/02/17 01:43:47]

huh? What happens inside focus?

[robwu, 2016/02/22 00:15:02]

It synchronously dispatches the focus event. A potentially untrusted focus
listener could detach the frame in the focus handler.

+            return;
+    }
 
     if (PluginView* view = pluginView())
         view->didReceiveResponse(document()->loader()->response());
@@ -124,8 +133,11 @@ void PluginDocumentParser::createDocumentStructure()
 
 void PluginDocumentParser::appendBytes(const char* data, size_t length)
 {
-    if (!m_embedElement)
+    if (!m_embedElement) {
         createDocumentStructure();
+        if (isStopped())
+            return;
+    }
 
     if (!length)
         return;