Fix PerformanceNavigationTiming accessor behavior after document detach.

third_party/WebKit/Source/core/timing/PerformanceNavigationTiming.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/timing/PerformanceNavigationTiming.h"
 
 #include "bindings/core/v8/V8ObjectBuilder.h"
 #include "core/dom/Document.h"
 #include "core/dom/DocumentTiming.h"
 #include "core/frame/LocalFrame.h"
 #include "core/loader/DocumentLoadTiming.h"
 #include "core/loader/DocumentLoader.h"
 #include "core/timing/PerformanceBase.h"
 #include "platform/loader/fetch/ResourceTimingInfo.h"
 
 namespace blink {
 
 PerformanceNavigationTiming::PerformanceNavigationTiming(
     LocalFrame* frame,
     ResourceTimingInfo* info,
     double timeOrigin)
     : PerformanceResourceTiming(info ? info->initialURL().getString() : "",
                                 "navigation",
                                 0.0,
                                 0.0),
+      ContextClient(frame),
       m_timeOrigin(timeOrigin),
-      m_resourceTimingInfo(info),
-      m_frame(frame) {
+      m_resourceTimingInfo(info) {
   DCHECK(frame);
   DCHECK(info);
 }
 
 PerformanceNavigationTiming::~PerformanceNavigationTiming() {}
 
 DEFINE_TRACE(PerformanceNavigationTiming) {
-  visitor->trace(m_frame);
+  ContextClient::trace(visitor);
   PerformanceEntry::trace(visitor);
 }
 
 DocumentLoadTiming* PerformanceNavigationTiming::documentLoadTiming() const {
   DocumentLoader* loader = documentLoader();
   if (!loader)
     return nullptr;
 
   return &loader->timing();
 }
 
 DocumentLoader* PerformanceNavigationTiming::documentLoader() const {
-  return m_frame->loader().documentLoader();
+  if (!frame())
+    return nullptr;
+  return frame()->loader().documentLoader();
 }
 
 const DocumentTiming* PerformanceNavigationTiming::documentTiming() const {
-  Document* document = m_frame->document();
+  if (!frame())
+    return nullptr;
+  Document* document = frame()->document();
   if (!document)
     return nullptr;
 
   return &document->timing();
 }
 
 ResourceLoadTiming* PerformanceNavigationTiming::resourceLoadTiming() const {
   return m_resourceTimingInfo->finalResponse().resourceLoadTiming();
 }
 
@@ skipping 15 matching lines @@
 
 unsigned long long PerformanceNavigationTiming::getDecodedBodySize() const {
   return m_resourceTimingInfo->finalResponse().decodedBodyLength();
 }
 
 AtomicString PerformanceNavigationTiming::initiatorType() const {
   return "navigation";
 }
 
 bool PerformanceNavigationTiming::getAllowRedirectDetails() const {
-  ExecutionContext* context = m_frame->document();
+  ExecutionContext* context = frame() ? frame()->document() : nullptr;
   SecurityOrigin* securityOrigin = nullptr;
   if (context)
     securityOrigin = context->getSecurityOrigin();
   if (!securityOrigin)
     return false;
   // TODO(sunjian): Think about how to make this flag deterministic.
   // crbug/693183.
   return PerformanceBase::allowsTimingRedirect(
       m_resourceTimingInfo->redirectChain(),
       m_resourceTimingInfo->finalResponse(), *securityOrigin, context);
@@ skipping 66 matching lines @@
 DOMHighResTimeStamp PerformanceNavigationTiming::loadEventEnd() const {
   DocumentLoadTiming* timing = documentLoadTiming();
   if (!timing)
     return 0.0;
   return PerformanceBase::monotonicTimeToDOMHighResTimeStamp(
       m_timeOrigin, timing->loadEventEnd());
 }
 
 AtomicString PerformanceNavigationTiming::type() const {
   DocumentLoader* loader = documentLoader();
-  DCHECK(loader);
-  Document* document = m_frame->document();
+  if (!loader)
+    return "navigate";
+  Document* document = frame() ? frame()->document(): nullptr;
   switch (PerformanceBase::getNavigationType(loader->getNavigationType(),
                                              document)) {
     case NavigationType::Prerender:
       return "prerender";
     case NavigationType::Reload:
       return "reload";
     case NavigationType::BackForward:
       return "back_forward";
     case NavigationType::Navigate:
       return "navigate";
@@ skipping 57 matching lines @@
   builder.addNumber("domInteractive", domInteractive());
   builder.addNumber("domContentLoadedEventStart", domContentLoadedEventStart());
   builder.addNumber("domContentLoadedEventEnd", domContentLoadedEventEnd());
   builder.addNumber("domComplete", domComplete());
   builder.addNumber("loadEventStart", loadEventStart());
   builder.addNumber("loadEventEnd", loadEventEnd());
   builder.addString("type", type());
   builder.addNumber("redirectCount", redirectCount());
 }
 }