Invalidate the previous frame when the window object is cleared.

extensions/renderer/script_injection_manager.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/script_injection_manager.h"
 
 #include "base/bind.h"
 #include "base/memory/weak_ptr.h"
 #include "base/values.h"
 #include "content/public/renderer/render_view.h"
@@ skipping 23 matching lines @@
 }  // namespace
 
 class ScriptInjectionManager::RVOHelper : public content::RenderViewObserver {
  public:
   RVOHelper(content::RenderView* render_view, ScriptInjectionManager* manager);
   ~RVOHelper() override;
 
  private:
   // RenderViewObserver implementation.
   bool OnMessageReceived(const IPC::Message& message) override;
+  void WillReleaseScriptContext(blink::WebLocalFrame* frame,
+                                v8::Handle<v8::Context> context,
+                                int world_id) override;
   void DidCreateDocumentElement(blink::WebLocalFrame* frame) override;
   void DidFinishDocumentLoad(blink::WebLocalFrame* frame) override;
   void DidFinishLoad(blink::WebLocalFrame* frame) override;
   void DidStartProvisionalLoad(blink::WebLocalFrame* frame) override;
   void FrameDetached(blink::WebFrame* frame) override;
   void OnDestruct() override;
 
   virtual void OnExecuteCode(const ExtensionMsg_ExecuteCode_Params& params);
   virtual void OnExecuteDeclarativeScript(int tab_id,
                                           const ExtensionId& extension_id,
@@ skipping 38 matching lines @@
     IPC_MESSAGE_HANDLER(ExtensionMsg_ExecuteCode, OnExecuteCode)
     IPC_MESSAGE_HANDLER(ExtensionMsg_PermitScriptInjection,
                         OnPermitScriptInjection)
     IPC_MESSAGE_HANDLER(ExtensionMsg_ExecuteDeclarativeScript,
                         OnExecuteDeclarativeScript)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
 }
 
+void ScriptInjectionManager::RVOHelper::WillReleaseScriptContext(
+    blink::WebLocalFrame* frame,
+    v8::Handle<v8::Context> context,
+    int world_id) {
+  // javascript:'...' frames are loaded in two steps:
+  // 1. Load an empty document and execute the JavaScript code.
+  // 2. If the JavaScript code returns a non-void value, replace the current
+  //    document with the return value.
+  // The second step is not implemented as a usual navigation, so we cannot use
+  // the DidStartProvisionalLoad or FrameDetached notifications to detect them.
+  // When a page unloads, the main world's script context is released. The main
+  // world for a blank document with a javascript:-URL always exists, because
+  // the javascript:-URL is evaluated in the main world.
+  if (world_id == 0) {

[dcheng, 2014/11/04 22:40:45]

0 should be a named constant somewhere. It's not clear from inspection that the
main world ID is 0 (I only happen to know that right now because I looked
through
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...
last night).

+    InvalidateFrame(frame);
+  }
+}
+
 void ScriptInjectionManager::RVOHelper::DidCreateDocumentElement(
     blink::WebLocalFrame* frame) {
   manager_->InjectScripts(frame, UserScript::DOCUMENT_START);
 }
 
 void ScriptInjectionManager::RVOHelper::DidFinishDocumentLoad(
     blink::WebLocalFrame* frame) {
   manager_->InjectScripts(frame, UserScript::DOCUMENT_END);
   pending_idle_frames_.insert(frame);
   // We try to run idle in two places: here and DidFinishLoad.
@@ skipping 288 matching lines @@
 
   ScriptsRunInfo scripts_run_info;
   if (injection->OnPermissionGranted(extensions_->GetByID(
                                          injection->extension_id()),
                                      &scripts_run_info)) {
     scripts_run_info.LogRun(injection->web_frame(), UserScript::RUN_DEFERRED);
   }
 }
 
 }  // namespace extensions