Fix a monkey crash when the new WebView is destroyed.
Grab the WebViewCore immediately so that if the Tab is destroyed, we have the
old WebViewCore object and can return the BrowserFrame.
Bug: 2733004
Change-Id: Ic3e4c5417f2165f412f60f05aea3ed403d8cecfd
diff --git a/core/java/android/webkit/BrowserFrame.java b/core/java/android/webkit/BrowserFrame.java
index 219a469..a2c80f2 100644
--- a/core/java/android/webkit/BrowserFrame.java
+++ b/core/java/android/webkit/BrowserFrame.java
@@ -785,11 +785,7 @@
* @return The BrowserFrame object stored in the new WebView.
*/
private BrowserFrame createWindow(boolean dialog, boolean userGesture) {
- WebView w = mCallbackProxy.createWindow(dialog, userGesture);
- if (w != null) {
- return w.getWebViewCore().getBrowserFrame();
- }
- return null;
+ return mCallbackProxy.createWindow(dialog, userGesture);
}
/**
diff --git a/core/java/android/webkit/CallbackProxy.java b/core/java/android/webkit/CallbackProxy.java
index 0e0e032..d65c106 100644
--- a/core/java/android/webkit/CallbackProxy.java
+++ b/core/java/android/webkit/CallbackProxy.java
@@ -1098,7 +1098,7 @@
}
}
- public WebView createWindow(boolean dialog, boolean userGesture) {
+ public BrowserFrame createWindow(boolean dialog, boolean userGesture) {
// Do an unsynchronized quick check to avoid posting if no callback has
// been set.
if (mWebChromeClient == null) {
@@ -1122,9 +1122,15 @@
WebView w = transport.getWebView();
if (w != null) {
- w.getWebViewCore().initializeSubwindow();
+ WebViewCore core = w.getWebViewCore();
+ // If WebView.destroy() has been called, core may be null. Skip
+ // initialization in that case and return null.
+ if (core != null) {
+ core.initializeSubwindow();
+ return core.getBrowserFrame();
+ }
}
- return w;
+ return null;
}
public void onRequestFocus() {