Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1247)

Unified Diff: Source/web/PopupContainer.cpp

Issue 517043003: Move Frame to the Oilpan heap. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master
Patch Set: Rebase past r181764 Created 6 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: Source/web/PopupContainer.cpp
diff --git a/Source/web/PopupContainer.cpp b/Source/web/PopupContainer.cpp
index 4b4ecdc998adf9690bda0162cc234cb121e13018..7a7c377e17bed44ea65430e4adfb02fe95056af0 100644
--- a/Source/web/PopupContainer.cpp
+++ b/Source/web/PopupContainer.cpp
@@ -240,7 +240,26 @@ void PopupContainer::notifyPopupHidden()
if (!m_popupOpen)
return;
m_popupOpen = false;
- WebViewImpl::fromPage(m_frameView->frame().page())->popupClosed(this);
+
+ // With Oilpan, we cannot assume that the FrameView's LocalFrame's
+ // page is still available, as the LocalFrame itself may have been
+ // detached from its FrameHost by now.
+ //
+ // So, if a popup menu is left in an open/shown state when
+ // finalized, the PopupMenu implementation of this container's
+ // listbox will hide itself when destructed, delivering this
+ // notifyPopupHidden() notification in the process. Should the
+ // LocalFrame have become detached first (when its
+ // HTMLFrameOwnerElement frame owner is detached as part of being
+ // finalized), the connection to the FrameHost has been snipped &
+ // there's no page. Hence the null check.
+ //
+ // (In a non-Oilpan setting, the object owning the PopupMenu and
+ // this PopupContainer is torn down and destructed before the
+ // frame and frame owner, hence the page will always be available
+ // here.)
+ if (WebViewImpl* webView = WebViewImpl::fromPage(m_frameView->frame().page()))
+ webView->popupClosed(this);
}
void PopupContainer::fitToListBox()

Powered by Google App Engine
This is Rietveld 408576698