Index: Source/core/loader/FrameLoader.cpp |
diff --git a/Source/core/loader/FrameLoader.cpp b/Source/core/loader/FrameLoader.cpp |
index bf7bcdd39de5b2398d7cec175fec149a7d187f50..9fa07815dbbe6d8895033221a5334e44cebcbc42 100644 |
--- a/Source/core/loader/FrameLoader.cpp |
+++ b/Source/core/loader/FrameLoader.cpp |
@@ -50,6 +50,7 @@ |
#include "core/fetch/ResourceLoader.h" |
#include "core/frame/LocalDOMWindow.h" |
#include "core/frame/FrameHost.h" |
+#include "core/frame/FrameProtector.h" |
#include "core/frame/FrameView.h" |
#include "core/frame/LocalFrame.h" |
#include "core/frame/PinchViewport.h" |
@@ -130,6 +131,12 @@ FrameLoader::~FrameLoader() |
{ |
} |
+void FrameLoader::trace(Visitor* visitor) |
+{ |
+ visitor->trace(m_frame); |
+ visitor->trace(m_fetchContext); |
+} |
+ |
void FrameLoader::init() |
{ |
ResourceRequest initialRequest(KURL(ParsedURLString, emptyString())); |
@@ -242,6 +249,9 @@ void FrameLoader::didExplicitOpen() |
void FrameLoader::clear() |
{ |
+ // clear() is called during (Local)Frame finalization and when creating |
+ // a new Document within it (DocumentLoader::createWriterFor().) |
+ |
if (m_stateMachine.creatingInitialEmptyDocument()) |
return; |
@@ -357,7 +367,8 @@ void FrameLoader::receivedFirstData() |
static void didFailContentSecurityPolicyCheck(FrameLoader* loader) |
{ |
// load event and stopAllLoaders can detach the LocalFrame, so protect it. |
- RefPtr<LocalFrame> frame(loader->frame()); |
+ LocalFrame* frame = loader->frame(); |
+ FrameProtector protect(frame); |
// Move the page to a unique origin, and cancel the load. |
frame->document()->enforceSandboxFlags(SandboxOrigin); |
@@ -420,7 +431,7 @@ void FrameLoader::finishedParsing() |
// This can be called from the LocalFrame's destructor, in which case we shouldn't protect ourselves |
// because doing so will cause us to re-enter the destructor when protector goes out of scope. |
// Null-checking the FrameView indicates whether or not we're in the destructor. |
- RefPtr<LocalFrame> protector = m_frame->view() ? m_frame : 0; |
+ FrameProtector protect(m_frame->view() ? m_frame : nullptr); |
if (client()) |
client()->dispatchDidFinishDocumentLoad(); |
@@ -464,7 +475,7 @@ bool FrameLoader::allAncestorsAreComplete() const |
void FrameLoader::checkCompleted() |
{ |
- RefPtr<LocalFrame> protect(m_frame); |
+ FrameProtector protect(m_frame); |
if (m_frame->view()) |
m_frame->view()->handleLoadCompleted(); |
@@ -606,7 +617,7 @@ void FrameLoader::loadInSameDocument(const KURL& url, PassRefPtr<SerializedScrip |
void FrameLoader::completed() |
{ |
- RefPtr<LocalFrame> protect(m_frame); |
+ FrameProtector protect(m_frame); |
for (Frame* descendant = m_frame->tree().traverseNext(m_frame); descendant; descendant = descendant->tree().traverseNext(m_frame)) { |
if (descendant->isLocalFrame()) |
@@ -730,7 +741,7 @@ void FrameLoader::load(const FrameLoadRequest& passedRequest) |
{ |
ASSERT(m_frame->document()); |
- RefPtr<LocalFrame> protect(m_frame); |
+ FrameProtector protect(m_frame); |
if (m_inStopAllLoaders) |
return; |
@@ -739,7 +750,8 @@ void FrameLoader::load(const FrameLoadRequest& passedRequest) |
if (!prepareRequestForThisFrame(request)) |
return; |
- RefPtr<LocalFrame> targetFrame = request.formState() ? 0 : findFrameForNavigation(AtomicString(request.frameName()), request.formState() ? request.formState()->sourceDocument() : m_frame->document()); |
+ LocalFrame* targetFrame = request.formState() ? 0 : findFrameForNavigation(AtomicString(request.frameName()), request.formState() ? request.formState()->sourceDocument() : m_frame->document()); |
+ FrameProtector protectTarget(targetFrame); |
if (targetFrame && targetFrame != m_frame) { |
request.setFrameName("_self"); |
targetFrame->loader().load(request); |
@@ -752,7 +764,7 @@ void FrameLoader::load(const FrameLoadRequest& passedRequest) |
NavigationAction action(request.resourceRequest(), newLoadType, request.formState(), request.triggeringEvent()); |
if (action.resourceRequest().requestContext() == WebURLRequest::RequestContextUnspecified) |
action.mutableResourceRequest().setRequestContext(determineRequestContextFromNavigationType(action.type())); |
- if (shouldOpenInNewWindow(targetFrame.get(), request, action)) { |
+ if (shouldOpenInNewWindow(targetFrame, request, action)) { |
if (action.policy() == NavigationPolicyDownload) |
client()->loadURLExternally(action.resourceRequest(), NavigationPolicyDownload); |
else |
@@ -852,11 +864,11 @@ void FrameLoader::stopAllLoaders() |
// Calling stopLoading() on the provisional document loader can blow away |
// the frame from underneath. |
- RefPtr<LocalFrame> protect(m_frame); |
+ FrameProtector protect(m_frame); |
m_inStopAllLoaders = true; |
- for (RefPtr<Frame> child = m_frame->tree().firstChild(); child; child = child->tree().nextSibling()) { |
+ for (RefPtrWillBeRawPtr<Frame> child = m_frame->tree().firstChild(); child; child = child->tree().nextSibling()) { |
if (child->isLocalFrame()) |
toLocalFrame(child.get())->loader().stopAllLoaders(); |
} |
@@ -914,7 +926,7 @@ void FrameLoader::commitProvisionalLoad() |
ASSERT(client()->hasWebView()); |
ASSERT(m_state == FrameStateProvisional); |
RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader; |
- RefPtr<LocalFrame> protect(m_frame); |
+ FrameProtector protect(m_frame); |
// Check if the destination page is allowed to access the previous page's timing information. |
if (m_frame->document()) { |
@@ -989,10 +1001,10 @@ static bool isDocumentDoneLoading(Document* document) |
bool FrameLoader::checkLoadCompleteForThisFrame() |
{ |
ASSERT(client()->hasWebView()); |
- RefPtr<LocalFrame> protect(m_frame); |
+ FrameProtector protect(m_frame); |
bool allChildrenAreDoneLoading = true; |
- for (RefPtr<Frame> child = m_frame->tree().firstChild(); child; child = child->tree().nextSibling()) { |
+ for (RefPtrWillBeRawPtr<Frame> child = m_frame->tree().firstChild(); child; child = child->tree().nextSibling()) { |
if (child->isLocalFrame()) |
allChildrenAreDoneLoading &= toLocalFrame(child.get())->loader().checkLoadCompleteForThisFrame(); |
} |
@@ -1120,7 +1132,9 @@ String FrameLoader::userAgent(const KURL& url) const |
void FrameLoader::detachFromParent() |
{ |
// The caller must protect a reference to m_frame. |
+#if !ENABLE(OILPAN) |
ASSERT(m_frame->refCount() > 1); |
+#endif |
InspectorInstrumentation::frameDetachedFromParent(m_frame); |
@@ -1174,7 +1188,7 @@ void FrameLoader::detachClient() |
void FrameLoader::receivedMainResourceError(const ResourceError& error) |
{ |
// Retain because the stop may release the last reference to it. |
- RefPtr<LocalFrame> protect(m_frame); |
+ FrameProtector protect(m_frame); |
if (m_frame->document()->parser()) |
m_frame->document()->parser()->stopParsing(); |
@@ -1216,7 +1230,8 @@ void FrameLoader::scrollToFragmentWithParentBoundary(const KURL& url) |
return; |
// Leaking scroll position to a cross-origin ancestor would permit the so-called "framesniffing" attack. |
- RefPtr<LocalFrame> boundaryFrame(url.hasFragmentIdentifier() ? m_frame->document()->findUnsafeParentScrollPropagationBoundary() : 0); |
+ LocalFrame* boundaryFrame = url.hasFragmentIdentifier() ? m_frame->document()->findUnsafeParentScrollPropagationBoundary() : 0; |
+ FrameProtector protect(boundaryFrame); |
if (boundaryFrame) |
boundaryFrame->view()->setSafeToPropagateScrollToParent(false); |
@@ -1234,7 +1249,7 @@ bool FrameLoader::shouldClose() |
return true; |
// Store all references to each subframe in advance since beforeunload's event handler may modify frame |
- Vector<RefPtr<LocalFrame> > targetFrames; |
+ WillBeHeapVector<RefPtrWillBeMember<LocalFrame> > targetFrames; |
targetFrames.append(m_frame); |
for (Frame* child = m_frame->tree().firstChild(); child; child = child->tree().traverseNext(m_frame)) { |
// FIXME: There is not yet any way to dispatch events to out-of-process frames. |
@@ -1321,7 +1336,7 @@ void FrameLoader::loadWithNavigationAction(const NavigationAction& action, Frame |
isTransitionNavigation = dispatchNavigationTransitionData(); |
// stopAllLoaders can detach the LocalFrame, so protect it. |
- RefPtr<LocalFrame> protect(m_frame); |
+ FrameProtector protect(m_frame); |
if ((!m_policyDocumentLoader->shouldContinueForNavigationPolicy(request, shouldCheckMainWorldContentSecurityPolicy, isTransitionNavigation) || !shouldClose()) && m_policyDocumentLoader) { |
m_policyDocumentLoader->detachFromFrame(); |
m_policyDocumentLoader = nullptr; |
@@ -1442,7 +1457,7 @@ LocalFrame* FrameLoader::findFrameForNavigation(const AtomicString& name, Docume |
void FrameLoader::loadHistoryItem(HistoryItem* item, HistoryLoadType historyLoadType, ResourceRequestCachePolicy cachePolicy) |
{ |
- RefPtr<LocalFrame> protect(m_frame); |
+ FrameProtector protect(m_frame); |
if (m_frame->page()->defersLoading()) { |
m_deferredHistoryLoad = DeferredHistoryLoad(item, historyLoadType, cachePolicy); |
return; |