Invalidate the previous frame when the window object is cleared.

extensions/renderer/script_injection_manager.cc

Index: extensions/renderer/script_injection_manager.cc
diff --git a/extensions/renderer/script_injection_manager.cc b/extensions/renderer/script_injection_manager.cc
index 436c4d00a0fd7e5c1f7f61d0fdf71fac148be73d..63fb61337a731a1d291761bfd54516bd9ee49a19 100644
--- a/extensions/renderer/script_injection_manager.cc
+++ b/extensions/renderer/script_injection_manager.cc
@@ -41,6 +41,9 @@ class ScriptInjectionManager::RVOHelper : public content::RenderViewObserver {
  private:
   // RenderViewObserver implementation.
   bool OnMessageReceived(const IPC::Message& message) override;
+  void WillReleaseScriptContext(blink::WebLocalFrame* frame,
+                                v8::Handle<v8::Context> context,
+                                int world_id) override;
   void DidCreateDocumentElement(blink::WebLocalFrame* frame) override;
   void DidFinishDocumentLoad(blink::WebLocalFrame* frame) override;
   void DidFinishLoad(blink::WebLocalFrame* frame) override;
@@ -99,6 +102,24 @@ bool ScriptInjectionManager::RVOHelper::OnMessageReceived(
   return handled;
 }
 
+void ScriptInjectionManager::RVOHelper::WillReleaseScriptContext(
+    blink::WebLocalFrame* frame,
+    v8::Handle<v8::Context> context,
+    int world_id) {
+  // javascript:'...' frames are loaded in two steps:
+  // 1. Load an empty document and execute the JavaScript code.
+  // 2. If the JavaScript code returns a non-void value, replace the current
+  //    document with the return value.
+  // The second step is not implemented as a usual navigation, so we cannot use
+  // the DidStartProvisionalLoad or FrameDetached notifications to detect them.
+  // When a page unloads, the main world's script context is released. The main
+  // world for a blank document with a javascript:-URL always exists, because
+  // the javascript:-URL is evaluated in the main world.
+  if (world_id == 0) {

[dcheng, 2014/11/04 22:40:45]

0 should be a named constant somewhere. It's not clear from inspection that the
main world ID is 0 (I only happen to know that right now because I looked
through
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...
last night).

+    InvalidateFrame(frame);
+  }
+}
+
 void ScriptInjectionManager::RVOHelper::DidCreateDocumentElement(
     blink::WebLocalFrame* frame) {
   manager_->InjectScripts(frame, UserScript::DOCUMENT_START);