Index: Source/web/PopupContainer.cpp |
diff --git a/Source/web/PopupContainer.cpp b/Source/web/PopupContainer.cpp |
index 4b4ecdc998adf9690bda0162cc234cb121e13018..7a7c377e17bed44ea65430e4adfb02fe95056af0 100644 |
--- a/Source/web/PopupContainer.cpp |
+++ b/Source/web/PopupContainer.cpp |
@@ -240,7 +240,26 @@ void PopupContainer::notifyPopupHidden() |
if (!m_popupOpen) |
return; |
m_popupOpen = false; |
- WebViewImpl::fromPage(m_frameView->frame().page())->popupClosed(this); |
+ |
+ // With Oilpan, we cannot assume that the FrameView's LocalFrame's |
+ // page is still available, as the LocalFrame itself may have been |
+ // detached from its FrameHost by now. |
+ // |
+ // So, if a popup menu is left in an open/shown state when |
+ // finalized, the PopupMenu implementation of this container's |
+ // listbox will hide itself when destructed, delivering this |
+ // notifyPopupHidden() notification in the process. Should the |
+ // LocalFrame have become detached first (when its |
+ // HTMLFrameOwnerElement frame owner is detached as part of being |
+ // finalized), the connection to the FrameHost has been snipped & |
+ // there's no page. Hence the null check. |
+ // |
+ // (In a non-Oilpan setting, the object owning the PopupMenu and |
+ // this PopupContainer is torn down and destructed before the |
+ // frame and frame owner, hence the page will always be available |
+ // here.) |
+ if (WebViewImpl* webView = WebViewImpl::fromPage(m_frameView->frame().page())) |
+ webView->popupClosed(this); |
} |
void PopupContainer::fitToListBox() |