After turning on page cache, the parent HistoryItem

can be destroyed before the child HistoryItem, add
an extra checking to avoid crash.

3 files changed, 20 insertions, 0 deletions

diff --git a/WebCore/history/HistoryItem.cpp b/WebCore/history/HistoryItem.cpp
index 2ca29e3..1e2bc93 100644
--- a/WebCore/history/HistoryItem.cpp
+++ b/WebCore/history/HistoryItem.cpp
@@ -97,6 +97,10 @@ HistoryItem::~HistoryItem()
 {
     ASSERT(!m_cachedPage);
     iconDatabase()->releaseIconForPageURL(m_urlString);
+#ifdef ANDROID_HISTORY_CLIENT
+    if (m_bridge)
+        m_bridge->detach(this);
+#endif
 }
 
 inline HistoryItem::HistoryItem(const HistoryItem& item)
diff --git a/WebKit/android/jni/WebHistory.cpp b/WebKit/android/jni/WebHistory.cpp
index 191f818..647dfb4 100644
--- a/WebKit/android/jni/WebHistory.cpp
+++ b/WebKit/android/jni/WebHistory.cpp
@@ -242,6 +242,14 @@ WebHistoryItem::~WebHistoryItem() {
     }
 }
 
+void WebHistoryItem::detach(WebCore::HistoryItem* item) {
+    if (mHistoryItem == item) {
+        mHistoryItem = NULL;
+    } else if (mHistoryItem) {
+        LOGE("WebHistoryItem::detach doesn't have a matching HistoryItem");
+    }
+}
+
 void WebHistoryItem::updateHistoryItem(WebCore::HistoryItem* item) {
     // Do not want to update during inflation.
     if (!m_active)
@@ -261,6 +269,13 @@ void WebHistoryItem::updateHistoryItem(WebCore::HistoryItem* item) {
         while (webItem->parent())
             webItem = webItem->parent();
         item = webItem->historyItem();
+        if (!item) {
+            // If a HistoryItem only exists for page cache, it is possible that
+            // the parent HistoryItem destroyed before the child HistoryItem. If
+            // it happens, skip updating.
+            LOGW("Can't updateHistoryItem as the top HistoryItem is gone");
+            return;
+        }
     }
     JNIEnv* env = JSC::Bindings::getJNIEnv();
     if (!env)
diff --git a/WebKit/android/jni/WebHistory.h b/WebKit/android/jni/WebHistory.h
index baba1fd..b756464 100644
--- a/WebKit/android/jni/WebHistory.h
+++ b/WebKit/android/jni/WebHistory.h
@@ -55,6 +55,7 @@ public:
         , m_object(NULL) { }
     WebHistoryItem(JNIEnv*, jobject, WebCore::HistoryItem*);
     ~WebHistoryItem();
+    void detach(WebCore::HistoryItem* item);
     void updateHistoryItem(WebCore::HistoryItem* item);
     void setParent(WebHistoryItem* parent) { m_parent = parent; }
     WebHistoryItem* parent() const { return m_parent.get(); }