Index: Source/web/PopupContainer.cpp |
diff --git a/Source/web/PopupContainer.cpp b/Source/web/PopupContainer.cpp |
index 35e901c5dbe44bff5bb384d306bc80ed3f159074..2cd76d0d44eab07619dec24301cbd7f7d7e7b049 100644 |
--- a/Source/web/PopupContainer.cpp |
+++ b/Source/web/PopupContainer.cpp |
@@ -240,7 +240,26 @@ void PopupContainer::notifyPopupHidden() |
if (!m_popupOpen) |
return; |
m_popupOpen = false; |
- WebViewImpl::fromPage(m_frameView->frame().page())->popupClosed(this); |
+ |
+ // With Oilpan, we cannot assume that the FrameView's LocalFrame's |
+ // page is still available, as the LocalFrame itself may have been |
+ // detached from its FrameHost by now. |
+ // |
+ // So, if a popup menu is left in an open/shown state when |
+ // finalized, the PopupMenu implementation of this container's |
+ // listbox will hide itself when destructed, delivering this |
+ // notifyPopupHidden() notification in the process. Should the |
+ // LocalFrame have become detached first (when its |
+ // HTMLFrameOwnerElement frame owner is detached as part of being |
+ // finalized), the connection to the FrameHost has been snipped & |
+ // there's no page. Hence the null check. |
+ // |
+ // (In a non-Oilpan setting, the object owning the PopupMenu and |
haraken
2014/09/11 14:47:26
Just help me understand: What's "the object"?
sof
2014/09/15 16:46:42
A RenderMenuList would be what's controller/owner
|
+ // this PopupContainer is torn down and destructed before the |
+ // frame and frame owner, hence the page will always be available |
+ // here.) |
+ if (WebViewImpl* webView = WebViewImpl::fromPage(m_frameView->frame().page())) |
+ webView->popupClosed(this); |
} |
void PopupContainer::fitToListBox() |