Uptake WebKit Changeset r149185.

Source/core/page/FrameView.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ skipping 2169 matching lines @@
 
 bool FrameView::updateWidgets()
 {
     if (m_nestedLayoutCount > 1 || !m_widgetUpdateSet || m_widgetUpdateSet->isEmpty())
         return true;
     
     size_t size = m_widgetUpdateSet->size();
 
     Vector<RenderObject*> objects;
     objects.reserveInitialCapacity(size);
+    // Protect RendereArena from getting wiped out, when Document is detached during updateWidget().
+    RefPtr<RenderArena> protectedArena = m_frame->document()->renderArena();
 
     RenderObjectSet::const_iterator end = m_widgetUpdateSet->end();
     for (RenderObjectSet::const_iterator it = m_widgetUpdateSet->begin(); it != end; ++it) {
         RenderObject* object = *it;
         objects.uncheckedAppend(object);
         if (object->isEmbeddedObject()) {
             RenderEmbeddedObject* embeddedObject = static_cast<RenderEmbeddedObject*>(object);
             embeddedObject->ref();
         }
     }
 
     for (size_t i = 0; i < size; ++i) {
         RenderObject* object = objects[i];
         updateWidget(object);
         m_widgetUpdateSet->remove(object);
     }
 
-    RenderArena* arena = m_frame->document()->renderArena();
     for (size_t i = 0; i < size; ++i) {
         RenderObject* object = objects[i];
         if (object->isEmbeddedObject()) {
             RenderEmbeddedObject* embeddedObject = static_cast<RenderEmbeddedObject*>(object);
-            embeddedObject->deref(arena);
+            embeddedObject->deref(protectedArena.get());
         }
     }
     
     return m_widgetUpdateSet->isEmpty();
 }
 
 void FrameView::flushAnyPendingPostLayoutTasks()
 {
     if (!m_postLayoutTasksTimer.isActive())
         return;
@@ skipping 62 matching lines @@
     scrollToAnchor();
 
     m_actionScheduler->resume();
 
     // Viewport-dependent media queries may cause us to need completely different style information.
     if (m_frame->document()->styleResolver()->affectedByViewportChange()) {
         m_frame->document()->styleResolverChanged(DeferRecalcStyle);
         InspectorInstrumentation::mediaQueryResultChanged(m_frame->document());
     }
 
+    // Refetch render view since it can be destroyed by updateWidget() call above.
+    renderView = this->renderView();
     if (renderView && !renderView->printing()) {
         IntSize currentSize;
         currentSize = visibleContentRect(IncludeScrollbars).size();
         float currentZoomFactor = renderView->style()->zoom();
         bool resized = !m_firstLayout && (currentSize != m_lastViewportSize || currentZoomFactor != m_lastZoomFactor);
         m_lastViewportSize = currentSize;
         m_lastZoomFactor = currentZoomFactor;
         if (resized) {
             m_frame->eventHandler()->sendResizeEvent();
             if (page && page->mainFrame() == m_frame)
@@ skipping 1102 matching lines @@
 }
 
 AXObjectCache* FrameView::axObjectCache() const
 {
     if (frame() && frame()->document())
         return frame()->document()->existingAXObjectCache();
     return 0;
 }
     
 } // namespace WebCore