Dispose ApplicationCacheHost on DocumentLoader finalization.

To cater to Oilpan, introduce an explicit dispose() for
ApplicationCacheHost, which the DocumentLoader will call upon when
being finalized.

Without it, a DocumentLoader might clear the Persistent reference to
its ApplicationCacheHost, but it'll still be accessible to embedder
notifications via its WebApplicationCacheHost until the next Oilpan GC
strikes. If so, the callbacks might access a now-dead DocumentLoader.

R=ager
BUG=

Review URL: https://codereview.chromium.org/571003002

git-svn-id: svn://svn.chromium.org/blink/trunk@181973 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/loader/DocumentLoader.cpp

@@ -105,6 +105,7 @@ DocumentLoader::~DocumentLoader()
     ASSERT(!m_frame || !isLoading());
     m_fetcher->clearDocumentLoader();
     clearMainResourceHandle();
+    m_applicationCacheHost->dispose();
 }
 
 unsigned long DocumentLoader::mainResourceIdentifier() const

third_party/WebKit/Source/core/loader/appcache/ApplicationCacheHost.cpp

@@ -164,6 +164,19 @@ void ApplicationCacheHost::setApplicationCache(ApplicationCache* domApplicationC
     m_domApplicationCache = domApplicationCache;
 }
 
+void ApplicationCacheHost::dispose()
+{
+    // FIXME: Oilpan: remove the dispose step when the owning DocumentLoader
+    // becomes a garbage collected object. Until that time, have the
+    // DocumentLoader dispose and disable this ApplicationCacheHost when
+    // it is finalized. Releasing the WebApplicationCacheHost is needed
+    // to prevent further embedder notifications, which risk accessing an
+    // invalid DocumentLoader.
+    setApplicationCache(0);
+    m_host.clear();
+    m_documentLoader = nullptr;
+}
+
 void ApplicationCacheHost::notifyApplicationCache(EventID id, int progressTotal, int progressDone, WebApplicationCacheHost::ErrorReason errorReason, const String& errorURL, int errorStatus, const String& errorMessage)
 {
     if (id != PROGRESS_EVENT)

third_party/WebKit/Source/core/loader/appcache/ApplicationCacheHost.h

@@ -52,6 +52,8 @@ namespace blink {
         }
         virtual ~ApplicationCacheHost();
 
+        void dispose();
+
         // The Status numeric values are specified in the HTML5 spec.
         enum Status {
             UNCACHED = 0,