Split content script injections into multiple tasks

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 698 matching lines @@
   // Only send didStopLoading() if there are no navigations in progress at all,
   // whether committed, provisional, or pending.
   return frame->loader().documentLoader()->sentDidFinishLoad() &&
          !frame->loader().hasProvisionalNavigation();
 }
 
 void FrameLoader::checkCompleted() {
   if (!shouldComplete(m_frame->document()))
     return;
 
+  if (client()) {
+    client()->runScriptsAtDocumentIdle();
+
+    // Check again, because runScriptsAtDocumentIdle() may have delayed the load
+    // event.
+    if (!shouldComplete(m_frame->document()))

[Devlin, 2017/02/21 18:56:26]

m_frame may be deleted at this point.

[Kunihiko Sakamoto, 2017/02/23 09:49:01]

Check added.

+      return;
+  }
+
   // OK, completed.
   m_frame->document()->setReadyState(Document::Complete);
   if (m_frame->document()->loadEventStillNeeded())
     m_frame->document()->implicitClose();
 
   m_frame->navigationScheduler().startTimer();
 
   if (m_frame->view())
     m_frame->view()->handleLoadCompleted();
 
@@ skipping 1281 matching lines @@
       frameLoadRequest.clientRedirect());
 
   loader->setLoadType(loadType);
   loader->setNavigationType(navigationType);
   loader->setReplacesCurrentHistoryItem(loadType ==
                                         FrameLoadTypeReplaceCurrentItem);
   return loader;
 }
 
 }  // namespace blink