Index: third_party/WebKit/Source/core/loader/FrameLoader.cpp |
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp |
index 038cf60a8afc2b21412fab348d49efb7f0661d53..1f562abead8228d7fbc06a0cb41ceb3d8287ef9a 100644 |
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp |
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp |
@@ -168,6 +168,7 @@ FrameLoader::FrameLoader(LocalFrame* frame) |
, m_didAccessInitialDocumentTimer(this, &FrameLoader::didAccessInitialDocumentTimerFired) |
, m_forcedSandboxFlags(SandboxNone) |
, m_dispatchingDidClearWindowObjectInMainWorld(false) |
+ , m_protectProvisionalLoader(false) |
{ |
} |
@@ -684,6 +685,8 @@ void FrameLoader::detachDocumentLoader(RefPtrWillBeMember<DocumentLoader>& loade |
{ |
if (!loader) |
return; |
+ if (loader == m_provisionalDocumentLoader && m_protectProvisionalLoader) |
+ return; |
loader->detachFromFrame(); |
loader = nullptr; |
@@ -1062,13 +1065,18 @@ bool FrameLoader::prepareForCommit() |
// we need to abandon the current load. |
if (pdl != m_provisionalDocumentLoader) |
return false; |
+ // detachFromFrame() will abort XHRs that haven't completed, which can |
+ // trigger event listeners for 'abort'. These event listeners might call |
+ // stop(), which will in turn detach the provisional document loader. |
+ // At this point, the provisional document loader should not detach, because |
+ // then the FrameLoader would not have any attached DocumentLoaders. |
if (m_documentLoader) { |
FrameNavigationDisabler navigationDisabler(*m_frame); |
+ m_protectProvisionalLoader = false; |
dcheng
2016/02/19 18:34:40
Shouldn't this be true?
Also, maybe use Temporary
|
detachDocumentLoader(m_documentLoader); |
+ m_protectProvisionalLoader = false; |
} |
- // detachFromFrame() will abort XHRs that haven't completed, which can |
- // trigger event listeners for 'abort'. These event listeners might detach |
- // the frame. |
+ // 'abort' listeners can also detach the frame. |
// TODO(dcheng): Investigate if this can be moved above the check that |
// m_provisionalDocumentLoader hasn't changed. |
if (!m_frame->client()) |
@@ -1077,6 +1085,7 @@ bool FrameLoader::prepareForCommit() |
// TODO(yoav): Should we also be nullifying domWindow's document (or domWindow) since the doc is now detached? |
if (m_frame->document()) |
m_frame->document()->detach(); |
+ ASSERT(m_provisionalDocumentLoader); |
m_documentLoader = m_provisionalDocumentLoader.release(); |
return true; |