Detach SpeechRecognitionController upon page detach.

Source/modules/speech/SpeechRecognition.cpp

Index: Source/modules/speech/SpeechRecognition.cpp
diff --git a/Source/modules/speech/SpeechRecognition.cpp b/Source/modules/speech/SpeechRecognition.cpp
index 06196eedf0925623ae539f848c1aa4669dddeea7..bf3e2bbfc2f797957b682d578caeebab9ef1cc4d 100644
--- a/Source/modules/speech/SpeechRecognition.cpp
+++ b/Source/modules/speech/SpeechRecognition.cpp
@@ -40,14 +40,21 @@ namespace blink {
 
 SpeechRecognition* SpeechRecognition::create(ExecutionContext* context)
 {
-    SpeechRecognition* speechRecognition = new SpeechRecognition(context);
+    ASSERT(context && context->isDocument());
+    Document* document = toDocument(context);
+    ASSERT(document);
+    LocalFrame* frame = document->frame();

[haraken, 2015/02/27 08:23:32]

Just to confirm: A frame is guaranteed to exist here because
SpeechRecognition::create can be created via JavaScript?

[sof, 2015/02/27 10:12:21]

Not in the general case, SpeechRecognition was vulnerable to crashing in
document/page/frame detached states.

I've made the constructor throw if it is now in such a detached state.

+    ASSERT(frame);
+    SpeechRecognition* speechRecognition = new SpeechRecognition(frame, context);
     speechRecognition->suspendIfNeeded();
     return speechRecognition;
 }
 
 void SpeechRecognition::start(ExceptionState& exceptionState)
 {
-    ASSERT(m_controller);
+    if (!m_controller)
+        return;
+
     if (m_started) {
         exceptionState.throwDOMException(InvalidStateError, "recognition has already started.");
         return;
@@ -60,7 +67,9 @@ void SpeechRecognition::start(ExceptionState& exceptionState)
 
 void SpeechRecognition::stopFunction()
 {
-    ASSERT(m_controller);
+    if (!m_controller)
+        return;
+
     if (m_started && !m_stopping) {
         m_stopping = true;
         m_controller->stop(this);
@@ -69,7 +78,9 @@ void SpeechRecognition::stopFunction()
 
 void SpeechRecognition::abort()
 {
-    ASSERT(m_controller);
+    if (!m_controller)
+        return;
+
     if (m_started && !m_stopping) {
         m_stopping = true;
         m_controller->abort(this);
@@ -166,8 +177,9 @@ bool SpeechRecognition::hasPendingActivity() const
     return m_started;
 }
 
-SpeechRecognition::SpeechRecognition(ExecutionContext* context)
-    : ActiveDOMObject(context)
+SpeechRecognition::SpeechRecognition(LocalFrame *frame, ExecutionContext* context)
+    : FrameDestructionObserver(frame)
+    , ActiveDOMObject(context)
     , m_grammars(SpeechGrammarList::create()) // FIXME: The spec is not clear on the default value for the grammars attribute.
     , m_audioTrack(nullptr)
     , m_continuous(false)
@@ -178,14 +190,10 @@ SpeechRecognition::SpeechRecognition(ExecutionContext* context)
     , m_started(false)
     , m_stopping(false)
 {
-    Document* document = toDocument(executionContext());
-
-    Page* page = document->page();
-    ASSERT(page);
-
-    m_controller = SpeechRecognitionController::from(page);
+    ASSERT(frame);
+    ASSERT(frame->page());
+    m_controller = SpeechRecognitionController::from(frame->page());
     ASSERT(m_controller);
-
     // FIXME: Need to hook up with Page to get notified when the visibility changes.
 }
 
@@ -193,6 +201,12 @@ SpeechRecognition::~SpeechRecognition()
 {
 }
 
+void SpeechRecognition::frameDestroyed()
+{
+    m_controller = nullptr;
+    FrameDestructionObserver::frameDestroyed();
+}
+
 DEFINE_TRACE(SpeechRecognition)
 {
     visitor->trace(m_grammars);
@@ -202,6 +216,7 @@ DEFINE_TRACE(SpeechRecognition)
 #endif
     visitor->trace(m_finalResults);
     RefCountedGarbageCollectedEventTargetWithInlineData<SpeechRecognition>::trace(visitor);
+    FrameDestructionObserver::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }