diff options
| author | ajwong@chromium.org <ajwong@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-11-14 00:56:43 +0000 |
|---|---|---|
| committer | ajwong@chromium.org <ajwong@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-11-14 00:56:43 +0000 |
| commit | cbf8849f3e446c86e29cc176d3214529d12a7a61 (patch) | |
| tree | ae73e00eecde58c6ed6e368a711adc23e5703001 /content/common | |
| parent | fae383c03632a1aabe7cac60b0fd6ec1b14d521a (diff) | |
| download | chromium_src-cbf8849f3e446c86e29cc176d3214529d12a7a61.zip chromium_src-cbf8849f3e446c86e29cc176d3214529d12a7a61.tar.gz chromium_src-cbf8849f3e446c86e29cc176d3214529d12a7a61.tar.bz2 | |
Fix frame detach message and lifetime issues for the mainframe RenderFrameImpl.
Previously, when RenderFrameImpl::frameDetach() was called on the mainframe, it would delete the RenderFrameImpl. The mainframe RFI is stored by RenderViewImpl in a scoped_ptr causing a double delete. This was not caught in testing because fast-path shutdown side-steps properly destroying the mainframe.
BUG=245126
Review URL: https://codereview.chromium.org/67313010
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@234992 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'content/common')
| -rw-r--r-- | content/common/swapped_out_messages.cc | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/content/common/swapped_out_messages.cc b/content/common/swapped_out_messages.cc index 05b5781..47acc35 100644 --- a/content/common/swapped_out_messages.cc +++ b/content/common/swapped_out_messages.cc @@ -5,6 +5,7 @@ #include "content/common/swapped_out_messages.h" #include "content/common/accessibility_messages.h" +#include "content/common/frame_messages.h" #include "content/common/input_messages.h" #include "content/common/view_messages.h" #include "content/public/common/content_client.h" @@ -35,6 +36,8 @@ bool SwappedOutMessages::CanSendWhileSwappedOut(const IPC::Message* msg) { // Allow cross-process JavaScript calls. case ViewHostMsg_RouteCloseEvent::ID: case ViewHostMsg_RouteMessageEvent::ID: + // Frame detach must occur after the RenderView has swapped out. + case FrameHostMsg_Detach::ID: return true; default: break; |