1 files changed, 11 insertions, 7 deletions
diff --git a/Source/WebCore/history/CachedFrame.cpp b/Source/WebCore/history/CachedFrame.cpp
index ab6b4d6..0059691 100644
--- a/Source/WebCore/history/CachedFrame.cpp
+++ b/Source/WebCore/history/CachedFrame.cpp
@@ -65,7 +65,7 @@ CachedFrameBase::CachedFrameBase(Frame* frame)
     , m_documentLoader(frame->loader()->documentLoader())
     , m_view(frame->view())
     , m_mousePressNode(frame->eventHandler()->mousePressNode())
-    , m_url(frame->loader()->url())
+    , m_url(frame->document()->url())
     , m_isMainFrame(!frame->tree()->parent())
 {
 }
@@ -135,10 +135,6 @@ CachedFrame::CachedFrame(Frame* frame)
     if (frame->page()->focusController()->focusedFrame() == frame)
         frame->page()->focusController()->setFocusedFrame(frame->page()->mainFrame());
 
-    // Active DOM objects must be suspended before we cached the frame script data
-    m_document->suspendActiveDOMObjects(ActiveDOMObject::DocumentWillBecomeInactive);
-    m_cachedFrameScriptData = adoptPtr(new ScriptCachedFrameData(frame));
-    
     // Custom scrollbar renderers will get reattached when the document comes out of the page cache
     m_view->detachCustomScrollbars();
 
@@ -146,13 +142,21 @@ CachedFrame::CachedFrame(Frame* frame)
     frame->clearTimers();
     m_document->setInPageCache(true);
     frame->loader()->stopLoading(UnloadEventPolicyUnloadAndPageHide);
-    
-    frame->loader()->client()->savePlatformDataToCachedFrame(this);
 
     // Create the CachedFrames for all Frames in the FrameTree.
     for (Frame* child = frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
         m_childFrames.append(CachedFrame::create(child));
 
+    // Active DOM objects must be suspended before we cache the frame script data,
+    // but after we've fired the pagehide event, in case that creates more objects.
+    // Suspending must also happen after we've recursed over child frames, in case
+    // those create more objects.
+    // FIXME: It's still possible to have objects created after suspending in some cases, see http://webkit.org/b/53733 for more details.
+    m_document->suspendActiveDOMObjects(ActiveDOMObject::DocumentWillBecomeInactive);
+    m_cachedFrameScriptData = adoptPtr(new ScriptCachedFrameData(frame));
+
+    frame->loader()->client()->savePlatformDataToCachedFrame(this);
+
     // Deconstruct the FrameTree, to restore it later.
     // We do this for two reasons:
     // 1 - We reuse the main frame, so when it navigates to a new page load it needs to start with a blank FrameTree.