Detach SpeechRecognitionController upon page detach.

Source/modules/speech/SpeechRecognition.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *  * Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  *  * Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 22 matching lines @@
 #include "core/page/Page.h"
 #include "modules/mediastream/MediaStreamTrack.h"
 #include "modules/speech/SpeechRecognitionController.h"
 #include "modules/speech/SpeechRecognitionError.h"
 #include "modules/speech/SpeechRecognitionEvent.h"
 
 namespace blink {
 
 SpeechRecognition* SpeechRecognition::create(ExecutionContext* context)
 {
-    SpeechRecognition* speechRecognition = new SpeechRecognition(context);
+    ASSERT(context && context->isDocument());
+    Document* document = toDocument(context);
+    ASSERT(document);
+    LocalFrame* frame = document->frame();

[haraken, 2015/02/27 08:23:32]

Just to confirm: A frame is guaranteed to exist here because
SpeechRecognition::create can be created via JavaScript?

[sof, 2015/02/27 10:12:21]

Not in the general case, SpeechRecognition was vulnerable to crashing in
document/page/frame detached states.

I've made the constructor throw if it is now in such a detached state.

+    ASSERT(frame);
+    SpeechRecognition* speechRecognition = new SpeechRecognition(frame, context);
     speechRecognition->suspendIfNeeded();
     return speechRecognition;
 }
 
 void SpeechRecognition::start(ExceptionState& exceptionState)
 {
-    ASSERT(m_controller);
+    if (!m_controller)
+        return;
+
     if (m_started) {
         exceptionState.throwDOMException(InvalidStateError, "recognition has already started.");
         return;
     }
 
     m_finalResults.clear();
     m_controller->start(this, m_grammars, m_lang, m_continuous, m_interimResults, m_maxAlternatives, m_audioTrack);
     m_started = true;
 }
 
 void SpeechRecognition::stopFunction()
 {
-    ASSERT(m_controller);
+    if (!m_controller)
+        return;
+
     if (m_started && !m_stopping) {
         m_stopping = true;
         m_controller->stop(this);
     }
 }
 
 void SpeechRecognition::abort()
 {
-    ASSERT(m_controller);
+    if (!m_controller)
+        return;
+
     if (m_started && !m_stopping) {
         m_stopping = true;
         m_controller->abort(this);
     }
 }
 
 void SpeechRecognition::didStartAudio()
 {
     dispatchEvent(Event::create(EventTypeNames::audiostart));
 }
@@ skipping 76 matching lines @@
     m_stoppedByActiveDOMObject = true;
     if (hasPendingActivity())
         abort();
 }
 
 bool SpeechRecognition::hasPendingActivity() const
 {
     return m_started;
 }
 
-SpeechRecognition::SpeechRecognition(ExecutionContext* context)
-    : ActiveDOMObject(context)
+SpeechRecognition::SpeechRecognition(LocalFrame *frame, ExecutionContext* context)
+    : FrameDestructionObserver(frame)
+    , ActiveDOMObject(context)
     , m_grammars(SpeechGrammarList::create()) // FIXME: The spec is not clear on the default value for the grammars attribute.
     , m_audioTrack(nullptr)
     , m_continuous(false)
     , m_interimResults(false)
     , m_maxAlternatives(1)
     , m_controller(nullptr)
     , m_stoppedByActiveDOMObject(false)
     , m_started(false)
     , m_stopping(false)
 {
-    Document* document = toDocument(executionContext());
-
-    Page* page = document->page();
-    ASSERT(page);
-
-    m_controller = SpeechRecognitionController::from(page);
+    ASSERT(frame);
+    ASSERT(frame->page());
+    m_controller = SpeechRecognitionController::from(frame->page());
     ASSERT(m_controller);
-
     // FIXME: Need to hook up with Page to get notified when the visibility changes.
 }
 
 SpeechRecognition::~SpeechRecognition()
 {
 }
 
+void SpeechRecognition::frameDestroyed()
+{
+    m_controller = nullptr;
+    FrameDestructionObserver::frameDestroyed();
+}
+
 DEFINE_TRACE(SpeechRecognition)
 {
     visitor->trace(m_grammars);
     visitor->trace(m_audioTrack);
 #if ENABLE(OILPAN)
     visitor->trace(m_controller);
 #endif
     visitor->trace(m_finalResults);
     RefCountedGarbageCollectedEventTargetWithInlineData<SpeechRecognition>::trace(visitor);
+    FrameDestructionObserver::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
 
 } // namespace blink