Copy Page::ordinaryPages() before undeferring loads.

third_party/WebKit/Source/core/page/ScopedPageLoadDeferrer.cpp

 /*
  * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 19 matching lines @@
 #include "wtf/Vector.h"
 
 namespace blink {
 
 namespace {
 
 unsigned s_deferralCount = 0;
 
 void setDefersLoading(bool isDeferred)
 {
+    // Make a copy of the collection. Undeferring loads can cause script to run,
+    // which would mutate ordinaryPages() in the middle of iteration.
+    HeapVector<Member<Page>> pages;
     for (const auto& page : Page::ordinaryPages())
+        pages.append(page);

[esprehn, 2016/08/16 02:31:42]

copyToVector(pages, Page::ordinaryPages())

+    for (const auto& page : pages)
         page->setDefersLoading(isDeferred);
 }
 
 } // namespace
 
 ScopedPageLoadDeferrer::ScopedPageLoadDeferrer()
 {
     if (++s_deferralCount > 1)
         return;
 
     setDefersLoading(true);
     Platform::current()->currentThread()->scheduler()->suspendTimerQueue();
 }
 
 ScopedPageLoadDeferrer::~ScopedPageLoadDeferrer()
 {
     if (--s_deferralCount > 0)
         return;
 
     setDefersLoading(false);
     Platform::current()->currentThread()->scheduler()->resumeTimerQueue();
 }
 
 bool ScopedPageLoadDeferrer::isActive()
 {
     return s_deferralCount > 0;
 }
 
 } // namespace blink