Dispose ApplicationCacheHost on DocumentLoader finalization.

Source/core/loader/appcache/ApplicationCacheHost.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 146 matching lines @@
         m_host->willStartSubResourceRequest(wrapped);
     }
 }
 
 void ApplicationCacheHost::setApplicationCache(ApplicationCache* domApplicationCache)
 {
     ASSERT(!m_domApplicationCache || !domApplicationCache);
     m_domApplicationCache = domApplicationCache;
 }
 
+void ApplicationCacheHost::dispose()
+{
+    // FIXME: Oilpan: remove the dispose step when the owning DocumentLoader
+    // becomes a garbage collected object. Until that time, have the
+    // DocumentLoader dispose and disable this ApplicationCacheHost when
+    // it is finalized. Releasing the WebApplicationCacheHost is needed
+    // to prevent further embedder notifications, which risk accessing an
+    // invalid DocumentLoader.
+    setApplicationCache(0);
+    m_host.clear();
+    m_documentLoader = nullptr;
+}
+
 void ApplicationCacheHost::notifyApplicationCache(EventID id, int progressTotal, int progressDone, WebApplicationCacheHost::ErrorReason errorReason, const String& errorURL, int errorStatus, const String& errorMessage)
 {
     if (id != PROGRESS_EVENT)
         InspectorInstrumentation::updateApplicationCacheStatus(m_documentLoader->frame());
 
     if (m_defersEvents) {
         // Event dispatching is deferred until document.onload has fired.
         m_deferredEvents.append(DeferredEvent(id, progressTotal, progressDone, errorReason, errorURL, errorStatus, errorMessage));
         return;
     }
@@ skipping 99 matching lines @@
 {
     notifyApplicationCache(ERROR_EVENT, 0, 0, reason, url.string(), status, message);
 }
 
 void ApplicationCacheHost::trace(Visitor* visitor)
 {
     visitor->trace(m_domApplicationCache);
 }
 
 } // namespace blink