Clear Document::m_frame after dispatching ContextLifecycleObesrver::contextDestroyed

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
@@ skipping 2252 matching lines @@
     // relationship. This ensures that we don't leave import loads in flight,
     // thinking they should have access to a valid frame when they don't.
     if (m_importsController) {
         m_importsController->dispose();
         setImportsController(nullptr);
     }
 
     m_timers.setTimerTaskRunner(
         Platform::current()->currentThread()->scheduler()->timerTaskRunner()->clone());
 
-    // This is required, as our LocalFrame might delete itself as soon as it detaches
-    // us. However, this violates Node::detachLayoutTree() semantics, as it's never
-    // possible to re-attach. Eventually Document::detachLayoutTree() should be renamed,
-    // or this setting of the frame to 0 could be made explicit in each of the
-    // callers of Document::detachLayoutTree().
-    m_frame = nullptr;
-
     if (m_mediaQueryMatcher)
         m_mediaQueryMatcher->documentDetached();
 
     m_lifecycle.advanceTo(DocumentLifecycle::Stopped);
 
     // FIXME: Currently we call notifyContextDestroyed() only in
     // Document::detachLayoutTree(), which means that we don't call
     // notifyContextDestroyed() for a document that doesn't get detached.
     // If such a document has any observer, the observer won't get
     // a contextDestroyed() notification. This can happen for a document
     // created by DOMImplementation::createDocument().
     ExecutionContext::notifyContextDestroyed();
+
+    // This is required, as our LocalFrame might delete itself as soon as it detaches
+    // us. However, this violates Node::detachLayoutTree() semantics, as it's never
+    // possible to re-attach. Eventually Document::detachLayoutTree() should be renamed,
+    // or this setting of the frame to 0 could be made explicit in each of the
+    // callers of Document::detachLayoutTree().
+    m_frame = nullptr;
 }
 
 void Document::removeAllEventListeners()
 {
     ContainerNode::removeAllEventListeners();
 
     if (LocalDOMWindow* domWindow = this->domWindow())
         domWindow->removeAllEventListeners();
 }
 
@@ skipping 3783 matching lines @@
 }
 
 void showLiveDocumentInstances()
 {
     WeakDocumentSet& set = liveDocumentSet();
     fprintf(stderr, "There are %u documents currently alive:\n", set.size());
     for (Document* document : set)
         fprintf(stderr, "- Document %p URL: %s\n", document, document->url().getString().utf8().data());
 }
 #endif