Protect the provisional loader from detaching during prepareForCommit

third_party/WebKit/Source/core/loader/FrameLoader.cpp

Index: third_party/WebKit/Source/core/loader/FrameLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index 038cf60a8afc2b21412fab348d49efb7f0661d53..1f562abead8228d7fbc06a0cb41ceb3d8287ef9a 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -168,6 +168,7 @@ FrameLoader::FrameLoader(LocalFrame* frame)
     , m_didAccessInitialDocumentTimer(this, &FrameLoader::didAccessInitialDocumentTimerFired)
     , m_forcedSandboxFlags(SandboxNone)
     , m_dispatchingDidClearWindowObjectInMainWorld(false)
+    , m_protectProvisionalLoader(false)
 {
 }
 
@@ -684,6 +685,8 @@ void FrameLoader::detachDocumentLoader(RefPtrWillBeMember<DocumentLoader>& loade
 {
     if (!loader)
         return;
+    if (loader == m_provisionalDocumentLoader && m_protectProvisionalLoader)
+        return;
 
     loader->detachFromFrame();
     loader = nullptr;
@@ -1062,13 +1065,18 @@ bool FrameLoader::prepareForCommit()
     // we need to abandon the current load.
     if (pdl != m_provisionalDocumentLoader)
         return false;
+    // detachFromFrame() will abort XHRs that haven't completed, which can
+    // trigger event listeners for 'abort'. These event listeners might call
+    // stop(), which will in turn detach the provisional document loader.
+    // At this point, the provisional document loader should not detach, because
+    // then the FrameLoader would not have any attached DocumentLoaders.
     if (m_documentLoader) {
         FrameNavigationDisabler navigationDisabler(*m_frame);
+        m_protectProvisionalLoader = false;

[dcheng, 2016/02/19 18:34:40]

Shouldn't this be true?

Also, maybe use TemporaryChange for this.

         detachDocumentLoader(m_documentLoader);
+        m_protectProvisionalLoader = false;
     }
-    // detachFromFrame() will abort XHRs that haven't completed, which can
-    // trigger event listeners for 'abort'. These event listeners might detach
-    // the frame.
+    // 'abort' listeners can also detach the frame.
     // TODO(dcheng): Investigate if this can be moved above the check that
     // m_provisionalDocumentLoader hasn't changed.
     if (!m_frame->client())
@@ -1077,6 +1085,7 @@ bool FrameLoader::prepareForCommit()
     // TODO(yoav): Should we also be nullifying domWindow's document (or domWindow) since the doc is now detached?
     if (m_frame->document())
         m_frame->document()->detach();
+    ASSERT(m_provisionalDocumentLoader);
     m_documentLoader = m_provisionalDocumentLoader.release();
 
     return true;