Make StorageArea cleanly observe its cached frame

Source/core/storage/StorageArea.cpp

 /*
  * Copyright (C) 2009 Google Inc. All Rights Reserved.
  *           (C) 2008 Apple Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 33 matching lines @@
 #include "public/platform/WebURL.h"
 
 namespace blink {
 
 PassOwnPtrWillBeRawPtr<StorageArea> StorageArea::create(PassOwnPtr<WebStorageArea> storageArea, StorageType storageType)
 {
     return adoptPtrWillBeNoop(new StorageArea(storageArea, storageType));
 }
 
 StorageArea::StorageArea(PassOwnPtr<WebStorageArea> storageArea, StorageType storageType)
-    : m_storageArea(storageArea)
+    : FrameDestructionObserver(nullptr)
+    , m_storageArea(storageArea)
     , m_storageType(storageType)
-    , m_canAccessStorageCachedFrame(nullptr)
     , m_canAccessStorageCachedResult(false)
 {
 }
 
 StorageArea::~StorageArea()
 {
 }
 
 void StorageArea::trace(Visitor* visitor)
 {
-    visitor->trace(m_canAccessStorageCachedFrame);
+    FrameDestructionObserver::trace(visitor);
 }
 
 unsigned StorageArea::length(ExceptionState& exceptionState, LocalFrame* frame)
 {
     if (!canAccessStorage(frame)) {
         exceptionState.throwSecurityError("access is denied for this document.");
         return 0;
     }
     return m_storageArea->length();
 }
@@ skipping 52 matching lines @@
         exceptionState.throwSecurityError("access is denied for this document.");
         return false;
     }
     return !getItem(key, exceptionState, frame).isNull();
 }
 
 bool StorageArea::canAccessStorage(LocalFrame* frame)
 {
     if (!frame || !frame->page())
         return false;
-    if (m_canAccessStorageCachedFrame == frame)
+
+    // FrameDestructionObserver is used to safely keep the cached
+    // reference to the LocalFrame. Should the LocalFrame die before
+    // this StorageArea does, that cached reference will be cleared.
+    if (m_frame == frame)
         return m_canAccessStorageCachedResult;
     bool result = frame->page()->storageClient().canAccessStorage(frame, m_storageType);
-    m_canAccessStorageCachedFrame = frame;
+    // Move attention to the new LocalFrame.
+    observeFrame(frame);
     m_canAccessStorageCachedResult = result;
     return result;
 }
 
 size_t StorageArea::memoryBytesUsedByCache()
 {
     return m_storageArea->memoryBytesUsedByCache();
 }
 
 void StorageArea::dispatchLocalStorageEvent(const String& key, const String& oldValue, const String& newValue, SecurityOrigin* securityOrigin, const KURL& pageURL, WebStorageArea* sourceAreaInstance, bool originatedInProcess)
@@ skipping 44 matching lines @@
 }
 
 bool StorageArea::isEventSource(Storage* storage, WebStorageArea* sourceAreaInstance)
 {
     ASSERT(storage);
     StorageArea* area = storage->area();
     return area->m_storageArea == sourceAreaInstance;
 }
 
 } // namespace blink