Oilpan: Delay frameDetached() so it won't dispatch event inside ~SVGImage

Source/core/svg/graphics/SVGImage.cpp

Index: Source/core/svg/graphics/SVGImage.cpp
diff --git a/Source/core/svg/graphics/SVGImage.cpp b/Source/core/svg/graphics/SVGImage.cpp
index baa838bad5aa32912a161c10e01f73acbbe90b56..453fc3278e8b026efff26a955e280557950a4d52 100644
--- a/Source/core/svg/graphics/SVGImage.cpp
+++ b/Source/core/svg/graphics/SVGImage.cpp
@@ -57,16 +57,55 @@ SVGImage::SVGImage(ImageObserver* observer)
 {
 }
 
-SVGImage::~SVGImage()
-{
-    if (m_page) {
-        // Store m_page in a local variable, clearing m_page, so that SVGImageChromeClient knows we're destructed.
-        OwnPtr<Page> currentPage = m_page.release();
-        currentPage->mainFrame()->loader().frameDetached(); // Break both the loader and view references to the frame
+class DelayedSVGImageDestructor {

[haraken, 2014/03/05 08:13:10]

Would you add a comment why you need this?

[kouhei (in TOK), 2014/03/05 08:27:33]

Done.

+public:
+    void add(PassOwnPtr<SVGImageChromeClient> chromeClient, PassOwnPtr<Page> page)
+    {
+        Entry entry;
+        entry.chromeClient = chromeClient.leakPtr();
+        entry.page = page.leakPtr();
+
+        m_entries.append(entry);
+        m_detachTimer.startOneShot(0.0);
+    }
+
+    static DelayedSVGImageDestructor* get()
+    {
+        DEFINE_STATIC_LOCAL(DelayedSVGImageDestructor, delayed, ());
+        return &delayed;
     }
 
-    // Verify that page teardown destroyed the Chrome
-    ASSERT(!m_chromeClient || !m_chromeClient->image());
+private:
+    DelayedSVGImageDestructor()
+        : m_detachTimer(this, &DelayedSVGImageDestructor::detachTimerFired)
+    {
+    }
+
+    void detachTimerFired(Timer<DelayedSVGImageDestructor>*)
+    {
+        Vector<Entry>::const_iterator it = m_entries.begin();
+        Vector<Entry>::const_iterator itEnd = m_entries.end();
+        for (; it != itEnd; ++it) {
+            it->page->mainFrame()->loader().frameDetached();
+            delete it->page;
+            delete it->chromeClient;
+        }
+
+        m_entries.clear();
+    }
+
+    struct Entry {
+        SVGImageChromeClient* chromeClient;
+        Page* page;
+    };
+    Vector<Entry> m_entries;
+    Timer<DelayedSVGImageDestructor> m_detachTimer;
+};
+
+SVGImage::~SVGImage()
+{
+    m_chromeClient->clearImage();
+    DelayedSVGImageDestructor::get()->add(m_chromeClient.release(), m_page.release());
 }
 
 bool SVGImage::isInSVGImage(const Element* element)