Should not call FocusController::setFocusedFrame() for detached frame

third_party/WebKit/Source/core/page/FocusController.cpp

 /*
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nuanti Ltd.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 754 matching lines @@
     }
 
     LocalFrame* newFocusedFrame = (frame && frame->isLocalFrame()) ? toLocalFrame(frame) : nullptr;
     if (newFocusedFrame && newFocusedFrame->view()) {
         Document* document = newFocusedFrame->document();
         Element* focusedElement = document ? document->focusedElement() : nullptr;
         if (focusedElement)
             dispatchFocusEvent(*document, *focusedElement);
     }
 
-    setFocusedFrame(frame, notifyEmbedder);
+    if (newFocusedFrame && newFocusedFrame->selection().isAvailable())
+        setFocusedFrame(frame, notifyEmbedder);

[yosin_UTC9, 2016/07/19 01:44:46]

I think we should check |LocalFrame::selection().isAvailable())| in
|FocusController::setFocusedFrame()| rather than here.

|dispatchEvent(blur)| at L737 can destroy |newFrame|.

720 void FocusController::setFocusedFrame(Frame* frame, bool notifyEmbedder)
...
734    // Now that the frame is updated, fire events and update the selection
focused states of both frames.
735    if (oldFrame && oldFrame->view()) {
736        oldFrame->selection().setFocused(false);
737       
oldFrame->domWindow()->dispatchEvent(Event::create(EventTypeNames::blur));
738    }
739
740    if (newFrame && newFrame->view() && isFocused()) {
741        newFrame->selection().setFocused(true);
742       
newFrame->domWindow()->dispatchEvent(Event::create(EventTypeNames::focus));
743    }

[kochi, 2016/07/20 08:05:27]

The original test case fails after dispatching events in this
function (line 764 and 772).

Let me try to fix the failing case first.

 }
 
 LocalFrame* FocusController::focusedFrame() const
 {
     // TODO(alexmos): Strengthen this to DCHECK that whoever called this really
     // expected a LocalFrame. Refactor call sites so that the rare cases that
     // need to know about focused RemoteFrames use a separate accessor (to be
     // added).
     if (m_focusedFrame && m_focusedFrame->isRemoteFrame())
         return nullptr;
@@ skipping 522 matching lines @@
     return consumed;
 }
 
 DEFINE_TRACE(FocusController)
 {
     visitor->trace(m_page);
     visitor->trace(m_focusedFrame);
 }
 
 } // namespace blink