Deal with frame removal by content scripts

third_party/WebKit/Source/core/html/ImageDocument.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 128 matching lines @@
     LocalFrame* frame = document()->frame();
     Settings* settings = frame->settings();
     if (!frame->loader().client()->allowImage(!settings || settings->imagesEnabled(), document()->url()))
         return;
 
     if (document()->cachedImage()) {
         RELEASE_ASSERT(length <= std::numeric_limits<unsigned>::max());
         document()->cachedImage()->appendData(data, length);
     }
 
-    // TODO(esprehn): These null checks on Document don't make sense, document()
-    // will ASSERT if it was null. Do these want to check isDetached() ?
-    if (document())
+    if (!isDetached())
         document()->imageUpdated();
 }
 
 void ImageDocumentParser::finish()
 {
     if (!isStopped() && document()->imageElement() && document()->cachedImage()) {
         ImageResource* cachedImage = document()->cachedImage();
         DocumentLoader* loader = document()->loader();
         cachedImage->setResponse(loader->response());
         cachedImage->setLoadFinishTime(loader->timing().responseEnd());
         cachedImage->finish();
 
         // Report the natural image size in the page title, regardless of zoom level.
         // At a zoom level of 1 the image is guaranteed to have an integer size.
         IntSize size = flooredIntSize(cachedImage->imageSize(LayoutObject::shouldRespectImageOrientation(document()->imageElement()->layoutObject()), 1.0f));
         if (size.width()) {
             // Compute the title, we use the decoded filename of the resource, falling
             // back on the (decoded) hostname if there is no path.
             String fileName = decodeURLEscapeSequences(document()->url().lastPathComponent());
             if (fileName.isEmpty())
                 fileName = document()->url().host();
             document()->setTitle(imageTitle(fileName, size));
+            if (isDetached())
+                return;
         }
 
         document()->imageUpdated();
     }
 
-    // TODO(esprehn): These null checks on Document don't make sense, document()
-    // will ASSERT if it was null. Do these want to check isDetached() ?
-    if (document())
+    if (!isDetached())
         document()->finishedParsing();
 }
 
 // --------
 
 ImageDocument::ImageDocument(const DocumentInit& initializer)
     : HTMLDocument(initializer, ImageDocumentClass)
     , m_imageElement(nullptr)
     , m_imageSizeIsKnown(false)
     , m_didShrinkImage(false)
     , m_shouldShrinkImage(shouldShrinkToFit())
     , m_shrinkToFitMode(frame()->settings()->viewportEnabled() ? Viewport : Desktop)
 {
     setCompatibilityMode(QuirksMode);
     lockCompatibilityMode();
 }
 
 PassRefPtrWillBeRawPtr<DocumentParser> ImageDocument::createParser()
 {
     return ImageDocumentParser::create(this);
 }
 
 void ImageDocument::createDocumentStructure(bool loadingMultipartContent)
 {
     RefPtrWillBeRawPtr<HTMLHtmlElement> rootElement = HTMLHtmlElement::create(*this);
     appendChild(rootElement);
     rootElement->insertedByParser();
 
-    if (frame())
-        frame()->loader().dispatchDocumentElementAvailable();
+    frame()->loader().dispatchDocumentElementAvailable();
+    frame()->loader().runScriptsAtDocumentElementAvailable();
+    if (isStopped())
+        return; // runScriptsAtDocumentElementAvailable can detach the frame.
     // Normally, ImageDocument creates an HTMLImageElement that doesn't actually load
     // anything, and the ImageDocument routes the main resource data into the HTMLImageElement's
     // ImageResource. However, the main resource pipeline doesn't know how to handle multipart content.
     // For multipart content, we instead stop streaming data through the main resource and re-request
     // the data directly.
     if (loadingMultipartContent)
         loader()->stopLoading();
 
     RefPtrWillBeRawPtr<HTMLHeadElement> head = HTMLHeadElement::create(*this);
     RefPtrWillBeRawPtr<HTMLMetaElement> meta = HTMLMetaElement::create(*this);
     meta->setAttribute(nameAttr, "viewport");
     meta->setAttribute(contentAttr, "width=device-width, minimum-scale=0.1");
     head->appendChild(meta);
 
     RefPtrWillBeRawPtr<HTMLBodyElement> body = HTMLBodyElement::create(*this);
     body->setAttribute(styleAttr, "margin: 0px;");
 
-    if (frame())
-        frame()->loader().client()->dispatchWillInsertBody();
+    frame()->loader().client()->dispatchWillInsertBody();
 
     m_imageElement = HTMLImageElement::create(*this);
     m_imageElement->setAttribute(styleAttr, "-webkit-user-select: none");
     // If the image is multipart, we neglect to mention to the HTMLImageElement that it's in an
     // ImageDocument, so that it requests the image normally.
     if (!loadingMultipartContent)
         m_imageElement->setLoadingImageDocument();
     m_imageElement->setSrc(url().string());
     body->appendChild(m_imageElement.get());
 
@@ skipping 168 matching lines @@
         if (!fitsInWindow) {
             resizeImageToFit(type);
             m_didShrinkImage = true;
         }
     }
 }
 
 ImageResource* ImageDocument::cachedImage()
 {
     bool loadingMultipartContent = loader() && loader()->loadingMultipartContent();
-    if (!m_imageElement)
+    if (!m_imageElement) {
         createDocumentStructure(loadingMultipartContent);
+        if (isStopped()) {
+            m_imageElement = nullptr;
+            return nullptr;
+        }
+    }
 
     return loadingMultipartContent ? nullptr : m_imageElement->cachedImage();
 }
 
 bool ImageDocument::shouldShrinkToFit() const
 {
     return frame()->isMainFrame();
 }
 
 #if !ENABLE(OILPAN)
@@ skipping 23 matching lines @@
 }
 
 bool ImageEventListener::operator==(const EventListener& listener) const
 {
     if (const ImageEventListener* imageEventListener = ImageEventListener::cast(&listener))
         return m_doc == imageEventListener->m_doc;
     return false;
 }
 
 } // namespace blink