From fdd2ae400181744b916fcc8319e68f1cec57c981 Mon Sep 17 00:00:00 2001
From: Grace Kloba <klobag@google.com>
Date: Wed, 2 Dec 2009 12:37:26 -0800
Subject: [PATCH] After turning on page cache, the parent HistoryItem can be
 destroyed before the child HistoryItem, add an extra checking to avoid crash.

---
 WebCore/history/HistoryItem.cpp   |  4 ++++
 WebKit/android/jni/WebHistory.cpp | 15 +++++++++++++++
 WebKit/android/jni/WebHistory.h   |  1 +
 3 files changed, 20 insertions(+)

diff --git a/WebCore/history/HistoryItem.cpp b/WebCore/history/HistoryItem.cpp
index 2ca29e3c1..1e2bc931a 100644
--- a/WebCore/history/HistoryItem.cpp
+++ b/WebCore/history/HistoryItem.cpp
@@ -97,6 +97,10 @@ HistoryItem::~HistoryItem()
 {
     ASSERT(!m_cachedPage);
     iconDatabase()->releaseIconForPageURL(m_urlString);
+#ifdef ANDROID_HISTORY_CLIENT
+    if (m_bridge)
+        m_bridge->detach(this);
+#endif
 }
 
 inline HistoryItem::HistoryItem(const HistoryItem& item)
diff --git a/WebKit/android/jni/WebHistory.cpp b/WebKit/android/jni/WebHistory.cpp
index 191f81883..647dfb4db 100644
--- a/WebKit/android/jni/WebHistory.cpp
+++ b/WebKit/android/jni/WebHistory.cpp
@@ -242,6 +242,14 @@ WebHistoryItem::~WebHistoryItem() {
     }
 }
 
+void WebHistoryItem::detach(WebCore::HistoryItem* item) {
+    if (mHistoryItem == item) {
+        mHistoryItem = NULL;
+    } else if (mHistoryItem) {
+        LOGE("WebHistoryItem::detach doesn't have a matching HistoryItem");
+    }
+}
+
 void WebHistoryItem::updateHistoryItem(WebCore::HistoryItem* item) {
     // Do not want to update during inflation.
     if (!m_active)
@@ -261,6 +269,13 @@ void WebHistoryItem::updateHistoryItem(WebCore::HistoryItem* item) {
         while (webItem->parent())
             webItem = webItem->parent();
         item = webItem->historyItem();
+        if (!item) {
+            // If a HistoryItem only exists for page cache, it is possible that
+            // the parent HistoryItem destroyed before the child HistoryItem. If
+            // it happens, skip updating.
+            LOGW("Can't updateHistoryItem as the top HistoryItem is gone");
+            return;
+        }
     }
     JNIEnv* env = JSC::Bindings::getJNIEnv();
     if (!env)
diff --git a/WebKit/android/jni/WebHistory.h b/WebKit/android/jni/WebHistory.h
index baba1fd97..b75646406 100644
--- a/WebKit/android/jni/WebHistory.h
+++ b/WebKit/android/jni/WebHistory.h
@@ -55,6 +55,7 @@ public:
         , m_object(NULL) { }
     WebHistoryItem(JNIEnv*, jobject, WebCore::HistoryItem*);
     ~WebHistoryItem();
+    void detach(WebCore::HistoryItem* item);
     void updateHistoryItem(WebCore::HistoryItem* item);
     void setParent(WebHistoryItem* parent) { m_parent = parent; }
     WebHistoryItem* parent() const { return m_parent.get(); }
-- 
2.11.0