Detached FrameLoader should not log snapshot trace events

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 1867 matching lines @@
   tracedValue->setString("provisionalDocumentLoaderURL",
                          m_provisionalDocumentLoader
                              ? m_provisionalDocumentLoader->url()
                              : String());
   tracedValue->setString("documentLoaderURL",
                          m_documentLoader ? m_documentLoader->url() : String());
   return tracedValue;
 }
 
 inline void FrameLoader::takeObjectSnapshot() const {
+  if (!m_progressTracker) {

[kouhei (in TOK), 2017/03/30 04:49:22]

Would you m_frame = nullptr in ::detach() and check for m_frame here?

[Kunihiko Sakamoto, 2017/03/30 05:08:58]

Hmm, ::clear() uses m_frame after ::detach() (called from LocalFrame::detach()),
so we cannot simply clear m_frame in ::detach().

[Kunihiko Sakamoto, 2017/03/30 05:52:22]

m_frame = nullptr in clear() didn't work either. Here's the clash trace, for the
record:

Received signal 11 SEGV_MAPERR 000000000028
#3 0x7fadfec17f8f blink::FrameLoader::effectiveSandboxFlags()
#4 0x7fadfe6e4652 blink::DocumentInit::getSandboxFlags()
#5 0x7fadfe6c15ab blink::Document::initSecurityContext()
#6 0x7fadfe6c0b07 blink::Document::Document()
#7 0x7fadfe8dad65 blink::HTMLDocument::HTMLDocument()
#8 0x7fadfe6b46c1 blink::HTMLDocument::create()
#9 0x7fadfe6b4872 blink::DOMImplementation::createDocument()
#10 0x7fadfe874db4 blink::LocalDOMWindow::createDocument()
#11 0x7fadfe874f81 blink::LocalDOMWindow::installNewDocument()
#12 0x7fadfec0513b blink::DocumentLoader::installNewDocument()
#13 0x7fadfec05062 blink::DocumentLoader::ensureWriter()
#14 0x7fadfec0448e blink::DocumentLoader::commitData()
#15 0x7fadfec04302 blink::DocumentLoader::finishedLoading()

I gave up clearing m_frame and added |m_detached| flag instead.

+    // We already logged TRACE_EVENT_OBJECT_DELETED_WITH_ID in detach().
+    return;
+  }
   TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID("loading", "FrameLoader", this,
                                       toTracedValue());
 }
 
 DocumentLoader* FrameLoader::createDocumentLoader(
     const ResourceRequest& request,
     const FrameLoadRequest& frameLoadRequest,
     FrameLoadType loadType,
     NavigationType navigationType) {
   DocumentLoader* loader = client()->createDocumentLoader(
       m_frame, request, frameLoadRequest.substituteData().isValid()
                             ? frameLoadRequest.substituteData()
                             : defaultSubstituteDataForURL(request.url()),
       frameLoadRequest.clientRedirect());
 
   loader->setLoadType(loadType);
   loader->setNavigationType(navigationType);
   loader->setReplacesCurrentHistoryItem(loadType ==
                                         FrameLoadTypeReplaceCurrentItem);
   return loader;
 }
 
 }  // namespace blink