Oilpan: clear FrameLoader during LocalFrame detach.

Source/core/frame/LocalFrame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 251 matching lines @@
     if (!client())
         return;
     m_loader.detach();
     setView(nullptr);
     willDetachFrameHost();
     // Notify ScriptController that the frame is closing, since its cleanup ends up calling
     // back to FrameLoaderClient via WindowProxy.
     script().clearForClose();
     InspectorInstrumentation::frameDetachedFromParent(this);
     Frame::detach();
+#if ENABLE(OILPAN)
+    // Clear the FrameLoader right here rather than during
+    // finalization. Too late to access various heap objects at that
+    // stage.
+    loader().clear();
+#endif
 }
 
 void LocalFrame::disconnectOwnerElement()
 {
     if (owner()) {
         if (Document* document = this->document())
             document->topDocument().clearAXObjectCache();
 #if ENABLE(OILPAN)
         // First give the plugin elements holding persisted,
         // renderer-less plugins the opportunity to dispose of them.
         for (const auto& pluginElement : m_pluginElements)
             pluginElement->disconnectContentFrame();
         m_pluginElements.clear();
-
-        // Clear the FrameView and FrameLoader right here rather than
-        // during finalization. Too late to access various heap objects
-        // at that stage.
-        setView(nullptr);

[dcheng, 2014/10/24 20:03:51]

One quick question--is this getting handled elsewhere now? I see that we call
FrameView::clear() in FrameLoader::clear().

[sof, 2014/10/24 20:05:41]

Yes, 5 lines up in LocalFrame::detach().

-        loader().clear();
 #endif
     }
     Frame::disconnectOwnerElement();
 }
 
 void LocalFrame::addDestructionObserver(FrameDestructionObserver* observer)
 {
     m_destructionObservers.add(observer);
 }
 
@@ skipping 483 matching lines @@
     // We detach the FrameView's custom scroll bars as early as
     // possible to prevent m_doc->detach() from messing with the view
     // such that its scroll bars won't be torn down.
     //
     // FIXME: We should revisit this.
     if (m_view)
         m_view->prepareForDetach();
 }
 
 } // namespace blink