Delay unregistering handlers when a document is detached

Delay unregistering handlers when a document is detached

When a document is detached, we need to unregister all event targets
within that document. Currently that is done too early, making it
possible for new handlers to get added into the registry before the
document is fully detached. This results in stale handlers getting left
in the registry, causing a crash an arbitrary amount of time later once
the registry is modified again.

This patch fixes the problem by clearing the registry immediately before
the document is actually detached, making it impossible for any new
handlers to be introduced.

BUG=393154
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=178865

[Sami, 2014-07-24 18:24:25]

Hi Rick, here's a crasher fix for you to look at. Unfortunately I haven't found
a reliable way to test this. In fact, it takes about 15 minutes of automated
clicking to even trigger this locally, and even when that happens you get a very
exotic looking stack trace involving v8 and PPAPI (see http://crbug.com/393154).
Not even clusterfuzz is able to hit this :(

I've tested this by running the automated clicker for a couple of hours -- no
crashes so far. This bug has been around since M36, and even though it's fairly
rare I'd really like to fix it.

[Rick Byers, 2014-07-24 19:42:16]

Wow, I'm amazed that this fix helps the situation.  It's not like we'd be
handling input events between the time we used to clear the registry and the
time that we now do.  Ideally we'd understand this and come up with a reliable
carefully choreographed repro.

But this change seems completely reasonable to me, at the worst it won't really
change anything, and I know you're about to head out on vacation.  So LGTM to
land this as is with no test.

Once you're back lets search the crash database to see if we can find any
similar crash reports on builds that contain this fix :-)

[Sami, 2014-07-24 19:54:05]

The CQ bit was checked by skyostil@chromium.org

[commit-bot: I haz the power, 2014-07-24 19:55:09]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/skyostil@chromium.org/415203003/1

[commit-bot: I haz the power, 2014-07-24 19:58:34]

Change committed as 178865