Detached FrameLoader should not log snapshot trace events

third_party/WebKit/Source/core/loader/FrameLoader.cpp

Index: third_party/WebKit/Source/core/loader/FrameLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index 1ef7f5649dbd8a7cc0ac629692f4d869ab15676e..646a31fc53e8442e6ed52e8d15101fc7928a0903 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -1885,6 +1885,10 @@ std::unique_ptr<TracedValue> FrameLoader::toTracedValue() const {
 }
 
 inline void FrameLoader::takeObjectSnapshot() const {
+  if (!m_progressTracker) {

[kouhei (in TOK), 2017/03/30 04:49:22]

Would you m_frame = nullptr in ::detach() and check for m_frame here?

[Kunihiko Sakamoto, 2017/03/30 05:08:58]

Hmm, ::clear() uses m_frame after ::detach() (called from LocalFrame::detach()),
so we cannot simply clear m_frame in ::detach().

[Kunihiko Sakamoto, 2017/03/30 05:52:22]

m_frame = nullptr in clear() didn't work either. Here's the clash trace, for the
record:

Received signal 11 SEGV_MAPERR 000000000028
#3 0x7fadfec17f8f blink::FrameLoader::effectiveSandboxFlags()
#4 0x7fadfe6e4652 blink::DocumentInit::getSandboxFlags()
#5 0x7fadfe6c15ab blink::Document::initSecurityContext()
#6 0x7fadfe6c0b07 blink::Document::Document()
#7 0x7fadfe8dad65 blink::HTMLDocument::HTMLDocument()
#8 0x7fadfe6b46c1 blink::HTMLDocument::create()
#9 0x7fadfe6b4872 blink::DOMImplementation::createDocument()
#10 0x7fadfe874db4 blink::LocalDOMWindow::createDocument()
#11 0x7fadfe874f81 blink::LocalDOMWindow::installNewDocument()
#12 0x7fadfec0513b blink::DocumentLoader::installNewDocument()
#13 0x7fadfec05062 blink::DocumentLoader::ensureWriter()
#14 0x7fadfec0448e blink::DocumentLoader::commitData()
#15 0x7fadfec04302 blink::DocumentLoader::finishedLoading()

I gave up clearing m_frame and added |m_detached| flag instead.

+    // We already logged TRACE_EVENT_OBJECT_DELETED_WITH_ID in detach().
+    return;
+  }
   TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID("loading", "FrameLoader", this,
                                       toTracedValue());
 }