<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[186887] trunk/Source/WebKit2</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/186887">186887</a></dd>
<dt>Author</dt> <dd>beidson@apple.com</dd>
<dt>Date</dt> <dd>2015-07-15 21:03:11 -0700 (Wed, 15 Jul 2015)</dd>
</dl>

<h3>Log Message</h3>
<pre>REGRESSION(<a href="http://trac.webkit.org/projects/webkit/changeset/186088">r186088</a>): Crash under WebKit::WebPageProxy::didFailLoadForFrame
&lt;rdar://problem/21692212&gt; and https://bugs.webkit.org/show_bug.cgi?id=146988

Reviewed by Sam Weinig.

When a loader delegate callback results in the WKView getting deallocated, then the PageClient
is also destroyed.

WebPageProxy then (often) turns around and uses the PageClient anyways.

Tried to write a TestWebKitAPI test for this, but only didFailLoadForFrame appears to obviously
be vulnerable, and there seems to be no way to reproduce that failure case under TestWebKitAPI.

* UIProcess/PageClient.h: Add ref/derefView.

* UIProcess/API/gtk/PageClientImpl.h: Stub them out.
            * UIProcess/efl/WebViewEfl.h: Stub them out.

* UIProcess/mac/PageClientImpl.h:
* UIProcess/mac/PageClientImpl.mm:
(WebKit::PageClientImpl::refView): [m_wkView retain]
(WebKit::PageClientImpl::derefView): [m_wkView release]

* UIProcess/ios/PageClientImplIOS.h:
* UIProcess/ios/PageClientImplIOS.mm:
(WebKit::PageClientImpl::refView): Retain all 3 views.
(WebKit::PageClientImpl::derefView): Release all 3 views.

* UIProcess/WebPageProxy.cpp:
(WebKit::PageClientProtector::PageClientProtector): Calls refView() on the PageClient.
(WebKit::PageClientProtector::~PageClientProtector): Calls derefView() on the PageClient.
(WebKit::WebPageProxy::didChangeBackForwardList): All methods that make m_loaderClient or
  m_pageClient callouts get a protector at their head.
(WebKit::WebPageProxy::willGoToBackForwardListItem):
(WebKit::WebPageProxy::shouldKeepCurrentBackForwardListItemInList):
(WebKit::WebPageProxy::findPlugin):
(WebKit::WebPageProxy::didCreateMainFrame):
(WebKit::WebPageProxy::didCreateSubframe):
(WebKit::WebPageProxy::didStartProgress):
(WebKit::WebPageProxy::didChangeProgress):
(WebKit::WebPageProxy::didFinishProgress):
(WebKit::WebPageProxy::didDestroyNavigation):
(WebKit::WebPageProxy::didStartProvisionalLoadForFrame):
(WebKit::WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame):
(WebKit::WebPageProxy::didChangeProvisionalURLForFrame):
(WebKit::WebPageProxy::didFailProvisionalLoadForFrame):
(WebKit::WebPageProxy::didCommitLoadForFrame):
(WebKit::WebPageProxy::didFinishDocumentLoadForFrame):
(WebKit::WebPageProxy::didFinishLoadForFrame):
(WebKit::WebPageProxy::didFailLoadForFrame):
(WebKit::WebPageProxy::didSameDocumentNavigationForFrame):
(WebKit::WebPageProxy::didReceiveTitleForFrame):
(WebKit::WebPageProxy::didFirstLayoutForFrame):
(WebKit::WebPageProxy::didFirstVisuallyNonEmptyLayoutForFrame):
(WebKit::WebPageProxy::didLayoutForCustomContentProvider):
(WebKit::WebPageProxy::didLayout):
(WebKit::WebPageProxy::didRemoveFrameFromHierarchy):
(WebKit::WebPageProxy::didDisplayInsecureContentForFrame):
(WebKit::WebPageProxy::didRunInsecureContentForFrame):
(WebKit::WebPageProxy::didDetectXSSForFrame):
(WebKit::WebPageProxy::frameDidBecomeFrameSet):
(WebKit::WebPageProxy::decidePolicyForNavigationAction):
(WebKit::WebPageProxy::decidePolicyForNewWindowAction):
(WebKit::WebPageProxy::decidePolicyForResponse):
(WebKit::WebPageProxy::decidePolicyForResponseSync):
(WebKit::WebPageProxy::unableToImplementPolicy):
(WebKit::WebPageProxy::didNavigateWithNavigationData):
(WebKit::WebPageProxy::didPerformClientRedirect):
(WebKit::WebPageProxy::didPerformServerRedirect):
(WebKit::WebPageProxy::didUpdateHistoryTitle):
(WebKit::WebPageProxy::wrapCryptoKey):
(WebKit::WebPageProxy::unwrapCryptoKey):
(WebKit::WebPageProxy::navigationGestureDidBegin):
(WebKit::WebPageProxy::navigationGestureWillEnd):
(WebKit::WebPageProxy::navigationGestureDidEnd):
(WebKit::WebPageProxy::willRecordNavigationSnapshot):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebKit2ChangeLog">trunk/Source/WebKit2/ChangeLog</a></li>
<li><a href="#trunkSourceWebKit2UIProcessAPIgtkPageClientImplh">trunk/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h</a></li>
<li><a href="#trunkSourceWebKit2UIProcessPageClienth">trunk/Source/WebKit2/UIProcess/PageClient.h</a></li>
<li><a href="#trunkSourceWebKit2UIProcessWebPageProxycpp">trunk/Source/WebKit2/UIProcess/WebPageProxy.cpp</a></li>
<li><a href="#trunkSourceWebKit2UIProcesseflWebViewEflh">trunk/Source/WebKit2/UIProcess/efl/WebViewEfl.h</a></li>
<li><a href="#trunkSourceWebKit2UIProcessiosPageClientImplIOSh">trunk/Source/WebKit2/UIProcess/ios/PageClientImplIOS.h</a></li>
<li><a href="#trunkSourceWebKit2UIProcessiosPageClientImplIOSmm">trunk/Source/WebKit2/UIProcess/ios/PageClientImplIOS.mm</a></li>
<li><a href="#trunkSourceWebKit2UIProcessmacPageClientImplh">trunk/Source/WebKit2/UIProcess/mac/PageClientImpl.h</a></li>
<li><a href="#trunkSourceWebKit2UIProcessmacPageClientImplmm">trunk/Source/WebKit2/UIProcess/mac/PageClientImpl.mm</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebKit2ChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/ChangeLog (186886 => 186887)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/ChangeLog        2015-07-16 02:42:51 UTC (rev 186886)
+++ trunk/Source/WebKit2/ChangeLog        2015-07-16 04:03:11 UTC (rev 186887)
</span><span class="lines">@@ -1,3 +1,82 @@
</span><ins>+2015-07-15  Brady Eidson  &lt;beidson@apple.com&gt;
+
+        REGRESSION(r186088): Crash under WebKit::WebPageProxy::didFailLoadForFrame
+        &lt;rdar://problem/21692212&gt; and https://bugs.webkit.org/show_bug.cgi?id=146988
+
+        Reviewed by Sam Weinig.
+
+        When a loader delegate callback results in the WKView getting deallocated, then the PageClient
+        is also destroyed.
+
+        WebPageProxy then (often) turns around and uses the PageClient anyways.
+
+        Tried to write a TestWebKitAPI test for this, but only didFailLoadForFrame appears to obviously 
+        be vulnerable, and there seems to be no way to reproduce that failure case under TestWebKitAPI.
+
+        * UIProcess/PageClient.h: Add ref/derefView.
+
+        * UIProcess/API/gtk/PageClientImpl.h: Stub them out.
+        * UIProcess/efl/WebViewEfl.h: Stub them out.
+
+        * UIProcess/mac/PageClientImpl.h:
+        * UIProcess/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::refView): [m_wkView retain]
+        (WebKit::PageClientImpl::derefView): [m_wkView release]
+
+        * UIProcess/ios/PageClientImplIOS.h:
+        * UIProcess/ios/PageClientImplIOS.mm:
+        (WebKit::PageClientImpl::refView): Retain all 3 views.
+        (WebKit::PageClientImpl::derefView): Release all 3 views.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::PageClientProtector::PageClientProtector): Calls refView() on the PageClient.
+        (WebKit::PageClientProtector::~PageClientProtector): Calls derefView() on the PageClient.
+        (WebKit::WebPageProxy::didChangeBackForwardList): All methods that make m_loaderClient or
+          m_pageClient callouts get a protector at their head.
+        (WebKit::WebPageProxy::willGoToBackForwardListItem):
+        (WebKit::WebPageProxy::shouldKeepCurrentBackForwardListItemInList):
+        (WebKit::WebPageProxy::findPlugin):
+        (WebKit::WebPageProxy::didCreateMainFrame):
+        (WebKit::WebPageProxy::didCreateSubframe):
+        (WebKit::WebPageProxy::didStartProgress):
+        (WebKit::WebPageProxy::didChangeProgress):
+        (WebKit::WebPageProxy::didFinishProgress):
+        (WebKit::WebPageProxy::didDestroyNavigation):
+        (WebKit::WebPageProxy::didStartProvisionalLoadForFrame):
+        (WebKit::WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame):
+        (WebKit::WebPageProxy::didChangeProvisionalURLForFrame):
+        (WebKit::WebPageProxy::didFailProvisionalLoadForFrame):
+        (WebKit::WebPageProxy::didCommitLoadForFrame):
+        (WebKit::WebPageProxy::didFinishDocumentLoadForFrame):
+        (WebKit::WebPageProxy::didFinishLoadForFrame):
+        (WebKit::WebPageProxy::didFailLoadForFrame):
+        (WebKit::WebPageProxy::didSameDocumentNavigationForFrame):
+        (WebKit::WebPageProxy::didReceiveTitleForFrame):
+        (WebKit::WebPageProxy::didFirstLayoutForFrame):
+        (WebKit::WebPageProxy::didFirstVisuallyNonEmptyLayoutForFrame):
+        (WebKit::WebPageProxy::didLayoutForCustomContentProvider):
+        (WebKit::WebPageProxy::didLayout):
+        (WebKit::WebPageProxy::didRemoveFrameFromHierarchy):
+        (WebKit::WebPageProxy::didDisplayInsecureContentForFrame):
+        (WebKit::WebPageProxy::didRunInsecureContentForFrame):
+        (WebKit::WebPageProxy::didDetectXSSForFrame):
+        (WebKit::WebPageProxy::frameDidBecomeFrameSet):
+        (WebKit::WebPageProxy::decidePolicyForNavigationAction):
+        (WebKit::WebPageProxy::decidePolicyForNewWindowAction):
+        (WebKit::WebPageProxy::decidePolicyForResponse):
+        (WebKit::WebPageProxy::decidePolicyForResponseSync):
+        (WebKit::WebPageProxy::unableToImplementPolicy):
+        (WebKit::WebPageProxy::didNavigateWithNavigationData):
+        (WebKit::WebPageProxy::didPerformClientRedirect):
+        (WebKit::WebPageProxy::didPerformServerRedirect):
+        (WebKit::WebPageProxy::didUpdateHistoryTitle):
+        (WebKit::WebPageProxy::wrapCryptoKey):
+        (WebKit::WebPageProxy::unwrapCryptoKey):
+        (WebKit::WebPageProxy::navigationGestureDidBegin):
+        (WebKit::WebPageProxy::navigationGestureWillEnd):
+        (WebKit::WebPageProxy::navigationGestureDidEnd):
+        (WebKit::WebPageProxy::willRecordNavigationSnapshot):
+
</ins><span class="cx"> 2015-07-15  Sam Weinig  &lt;sam@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Color match plug-ins
</span></span></pre></div>
<a id="trunkSourceWebKit2UIProcessAPIgtkPageClientImplh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h (186886 => 186887)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h        2015-07-16 02:42:51 UTC (rev 186886)
+++ trunk/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h        2015-07-16 04:03:11 UTC (rev 186887)
</span><span class="lines">@@ -1,3 +1,4 @@
</span><ins>+
</ins><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2010 Apple Inc. All rights reserved.
</span><span class="cx">  * Portions Copyright (c) 2010 Motorola Mobility, Inc.  All rights reserved.
</span><span class="lines">@@ -134,6 +135,9 @@
</span><span class="cx"> 
</span><span class="cx">     virtual void didChangeBackgroundColor() override;
</span><span class="cx"> 
</span><ins>+    virtual void refView() override { };
+    virtual void derefView() override { };
+
</ins><span class="cx">     // Members of PageClientImpl class
</span><span class="cx">     GtkWidget* m_viewWidget;
</span><span class="cx">     DefaultUndoController m_undoController;
</span></span></pre></div>
<a id="trunkSourceWebKit2UIProcessPageClienth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/UIProcess/PageClient.h (186886 => 186887)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/UIProcess/PageClient.h        2015-07-16 02:42:51 UTC (rev 186886)
+++ trunk/Source/WebKit2/UIProcess/PageClient.h        2015-07-16 04:03:11 UTC (rev 186887)
</span><span class="lines">@@ -326,6 +326,8 @@
</span><span class="cx">     virtual WebCore::WebMediaSessionManager&amp; mediaSessionManager() = 0;
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><ins>+    virtual void refView() = 0;
+    virtual void derefView() = 0;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebKit
</span></span></pre></div>
<a id="trunkSourceWebKit2UIProcessWebPageProxycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/UIProcess/WebPageProxy.cpp (186886 => 186887)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/UIProcess/WebPageProxy.cpp        2015-07-16 02:42:51 UTC (rev 186886)
+++ trunk/Source/WebKit2/UIProcess/WebPageProxy.cpp        2015-07-16 04:03:11 UTC (rev 186887)
</span><span class="lines">@@ -274,6 +274,24 @@
</span><span class="cx"> }
</span><span class="cx"> #endif // !LOG_DISABLED
</span><span class="cx"> 
</span><ins>+class PageClientProtector {
+    WTF_MAKE_NONCOPYABLE(PageClientProtector);
+public:
+    PageClientProtector(PageClient&amp; pageClient)
+        : m_pageClient(pageClient)
+    {
+        m_pageClient.refView();
+    }
+
+    ~PageClientProtector()
+    {
+        m_pageClient.derefView();
+    }
+
+private:
+    PageClient&amp; m_pageClient;
+};
+
</ins><span class="cx"> Ref&lt;WebPageProxy&gt; WebPageProxy::create(PageClient&amp; pageClient, WebProcessProxy&amp; process, uint64_t pageID, const WebPageConfiguration&amp; configuration)
</span><span class="cx"> {
</span><span class="cx">     return adoptRef(*new WebPageProxy(pageClient, process, pageID, configuration));
</span><span class="lines">@@ -1140,6 +1158,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didChangeBackForwardList(WebBackForwardListItem* added, Vector&lt;RefPtr&lt;WebBackForwardListItem&gt;&gt; removed)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     m_loaderClient-&gt;didChangeBackForwardList(*this, added, WTF::move(removed));
</span><span class="cx"> 
</span><span class="cx">     auto transaction = m_pageLoadState.transaction();
</span><span class="lines">@@ -1150,12 +1170,16 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::willGoToBackForwardListItem(uint64_t itemID, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     if (WebBackForwardListItem* item = m_process-&gt;webBackForwardItem(itemID))
</span><span class="cx">         m_loaderClient-&gt;willGoToBackForwardListItem(*this, item, m_process-&gt;transformHandlesToObjects(userData.object()).get());
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool WebPageProxy::shouldKeepCurrentBackForwardListItemInList(WebBackForwardListItem* item)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     return m_loaderClient-&gt;shouldKeepCurrentBackForwardListItemInList(*this, item);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1826,6 +1850,8 @@
</span><span class="cx"> #if ENABLE(NETSCAPE_PLUGIN_API)
</span><span class="cx"> void WebPageProxy::findPlugin(const String&amp; mimeType, uint32_t processType, const String&amp; urlString, const String&amp; frameURLString, const String&amp; pageURLString, bool allowOnlyApplicationPlugins, uint64_t&amp; pluginProcessToken, String&amp; newMimeType, uint32_t&amp; pluginLoadPolicy, String&amp; unavailabilityDescription)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     MESSAGE_CHECK_URL(urlString);
</span><span class="cx"> 
</span><span class="cx">     newMimeType = mimeType.lower();
</span><span class="lines">@@ -2742,6 +2768,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didCreateMainFrame(uint64_t frameID)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     MESSAGE_CHECK(!m_mainFrame);
</span><span class="cx">     MESSAGE_CHECK(m_process-&gt;canCreateFrame(frameID));
</span><span class="cx"> 
</span><span class="lines">@@ -2753,6 +2781,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didCreateSubframe(uint64_t frameID)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     MESSAGE_CHECK(m_mainFrame);
</span><span class="cx">     MESSAGE_CHECK(m_process-&gt;canCreateFrame(frameID));
</span><span class="cx">     
</span><span class="lines">@@ -2769,6 +2799,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didStartProgress()
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     auto transaction = m_pageLoadState.transaction();
</span><span class="cx">     m_pageLoadState.didStartProgress(transaction);
</span><span class="cx"> 
</span><span class="lines">@@ -2778,6 +2810,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didChangeProgress(double value)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     auto transaction = m_pageLoadState.transaction();
</span><span class="cx">     m_pageLoadState.didChangeProgress(transaction, value);
</span><span class="cx"> 
</span><span class="lines">@@ -2787,6 +2821,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didFinishProgress()
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     auto transaction = m_pageLoadState.transaction();
</span><span class="cx">     m_pageLoadState.didFinishProgress(transaction);
</span><span class="cx"> 
</span><span class="lines">@@ -2802,12 +2838,16 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didDestroyNavigation(uint64_t navigationID)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     // FIXME: Message check the navigationID.
</span><span class="cx">     m_navigationState-&gt;didDestroyNavigation(navigationID);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didStartProvisionalLoadForFrame(uint64_t frameID, uint64_t navigationID, const String&amp; url, const String&amp; unreachableURL, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     auto transaction = m_pageLoadState.transaction();
</span><span class="cx"> 
</span><span class="cx">     m_pageLoadState.clearPendingAPIRequestURL(transaction);
</span><span class="lines">@@ -2837,6 +2877,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame(uint64_t frameID, uint64_t navigationID, const String&amp; url, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx">     MESSAGE_CHECK_URL(url);
</span><span class="lines">@@ -2863,6 +2905,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didChangeProvisionalURLForFrame(uint64_t frameID, uint64_t, const String&amp; url)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx">     MESSAGE_CHECK(frame-&gt;frameLoadState().state() == FrameLoadState::State::Provisional);
</span><span class="lines">@@ -2880,6 +2924,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didFailProvisionalLoadForFrame(uint64_t frameID, const SecurityOriginData&amp; frameSecurityOrigin, uint64_t navigationID, const String&amp; provisionalURL, const ResourceError&amp; error, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -2928,6 +2974,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didCommitLoadForFrame(uint64_t frameID, uint64_t navigationID, const String&amp; mimeType, bool frameHasCustomContentProvider, uint32_t opaqueFrameLoadType, const WebCore::CertificateInfo&amp; certificateInfo, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -2998,6 +3046,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didFinishDocumentLoadForFrame(uint64_t frameID, uint64_t navigationID, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -3015,6 +3065,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didFinishLoadForFrame(uint64_t frameID, uint64_t navigationID, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -3044,6 +3096,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didFailLoadForFrame(uint64_t frameID, uint64_t navigationID, const ResourceError&amp; error, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -3076,6 +3130,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didSameDocumentNavigationForFrame(uint64_t frameID, uint64_t navigationID, uint32_t opaqueSameDocumentNavigationType, const String&amp; url, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx">     MESSAGE_CHECK_URL(url);
</span><span class="lines">@@ -3109,6 +3165,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didReceiveTitleForFrame(uint64_t frameID, const String&amp; title, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -3125,6 +3183,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didFirstLayoutForFrame(uint64_t frameID, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -3133,6 +3193,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didFirstVisuallyNonEmptyLayoutForFrame(uint64_t frameID, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -3144,6 +3206,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didLayoutForCustomContentProvider()
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     LayoutMilestones milestones = DidFirstLayout | DidFirstVisuallyNonEmptyLayout | DidHitRelevantRepaintedObjectsAreaThreshold;
</span><span class="cx">     if (m_navigationClient)
</span><span class="cx">         m_navigationClient-&gt;renderingProgressDidChange(*this, milestones, nullptr);
</span><span class="lines">@@ -3153,6 +3217,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didLayout(uint32_t layoutMilestones, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     if (m_navigationClient)
</span><span class="cx">         m_navigationClient-&gt;renderingProgressDidChange(*this, static_cast&lt;LayoutMilestones&gt;(layoutMilestones), m_process-&gt;transformHandlesToObjects(userData.object()).get());
</span><span class="cx">     else
</span><span class="lines">@@ -3161,6 +3227,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didRemoveFrameFromHierarchy(uint64_t frameID, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -3169,6 +3237,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didDisplayInsecureContentForFrame(uint64_t frameID, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -3181,6 +3251,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didRunInsecureContentForFrame(uint64_t frameID, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -3193,6 +3265,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didDetectXSSForFrame(uint64_t frameID, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -3201,6 +3275,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::frameDidBecomeFrameSet(uint64_t frameID, bool value)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -3211,6 +3287,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::decidePolicyForNavigationAction(uint64_t frameID, const SecurityOriginData&amp; frameSecurityOrigin, uint64_t navigationID, const NavigationActionData&amp; navigationActionData, uint64_t originatingFrameID, const SecurityOriginData&amp; originatingFrameSecurityOrigin, const WebCore::ResourceRequest&amp; originalRequest, const ResourceRequest&amp; request, uint64_t listenerID, const UserData&amp; userData, bool&amp; receivedPolicyAction, uint64_t&amp; newNavigationID, uint64_t&amp; policyAction, uint64_t&amp; downloadID)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     auto transaction = m_pageLoadState.transaction();
</span><span class="cx"> 
</span><span class="cx">     if (request.url() != m_pageLoadState.pendingAPIRequestURL())
</span><span class="lines">@@ -3275,6 +3353,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::decidePolicyForNewWindowAction(uint64_t frameID, const SecurityOriginData&amp; frameSecurityOrigin, const NavigationActionData&amp; navigationActionData, const ResourceRequest&amp; request, const String&amp; frameName, uint64_t listenerID, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx">     MESSAGE_CHECK_URL(request.url());
</span><span class="lines">@@ -3296,6 +3376,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::decidePolicyForResponse(uint64_t frameID, const SecurityOriginData&amp; frameSecurityOrigin, const ResourceResponse&amp; response, const ResourceRequest&amp; request, bool canShowMIMEType, uint64_t listenerID, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx">     MESSAGE_CHECK_URL(request.url());
</span><span class="lines">@@ -3312,6 +3394,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::decidePolicyForResponseSync(uint64_t frameID, const SecurityOriginData&amp; frameSecurityOrigin, const ResourceResponse&amp; response, const ResourceRequest&amp; request, bool canShowMIMEType, uint64_t listenerID, const UserData&amp; userData, bool&amp; receivedPolicyAction, uint64_t&amp; policyAction, uint64_t&amp; downloadID)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     ASSERT(!m_inDecidePolicyForResponseSync);
</span><span class="cx"> 
</span><span class="cx">     m_inDecidePolicyForResponseSync = true;
</span><span class="lines">@@ -3333,6 +3417,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::unableToImplementPolicy(uint64_t frameID, const ResourceError&amp; error, const UserData&amp; userData)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx"> 
</span><span class="lines">@@ -3355,6 +3441,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didNavigateWithNavigationData(const WebNavigationDataStore&amp; store, uint64_t frameID) 
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx">     MESSAGE_CHECK(frame-&gt;page() == this);
</span><span class="lines">@@ -3369,6 +3457,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didPerformClientRedirect(const String&amp; sourceURLString, const String&amp; destinationURLString, uint64_t frameID)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     if (sourceURLString.isEmpty() || destinationURLString.isEmpty())
</span><span class="cx">         return;
</span><span class="cx">     
</span><span class="lines">@@ -3389,6 +3479,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didPerformServerRedirect(const String&amp; sourceURLString, const String&amp; destinationURLString, uint64_t frameID)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     if (sourceURLString.isEmpty() || destinationURLString.isEmpty())
</span><span class="cx">         return;
</span><span class="cx">     
</span><span class="lines">@@ -3409,6 +3501,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::didUpdateHistoryTitle(const String&amp; title, const String&amp; url, uint64_t frameID)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     WebFrameProxy* frame = m_process-&gt;webFrame(frameID);
</span><span class="cx">     MESSAGE_CHECK(frame);
</span><span class="cx">     MESSAGE_CHECK(frame-&gt;page() == this);
</span><span class="lines">@@ -5646,6 +5740,8 @@
</span><span class="cx"> #if ENABLE(SUBTLE_CRYPTO)
</span><span class="cx"> void WebPageProxy::wrapCryptoKey(const Vector&lt;uint8_t&gt;&amp; key, bool&amp; succeeded, Vector&lt;uint8_t&gt;&amp; wrappedKey)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     Vector&lt;uint8_t&gt; masterKey;
</span><span class="cx"> 
</span><span class="cx">     if (m_navigationClient) {
</span><span class="lines">@@ -5663,6 +5759,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::unwrapCryptoKey(const Vector&lt;uint8_t&gt;&amp; wrappedKey, bool&amp; succeeded, Vector&lt;uint8_t&gt;&amp; key)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     Vector&lt;uint8_t&gt; masterKey;
</span><span class="cx"> 
</span><span class="cx">     if (m_navigationClient) {
</span><span class="lines">@@ -5784,6 +5882,8 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::navigationGestureDidBegin()
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     m_isShowingNavigationGestureSnapshot = true;
</span><span class="cx">     m_pageClient.navigationGestureDidBegin();
</span><span class="cx">     m_loaderClient-&gt;navigationGestureDidBegin(*this);
</span><span class="lines">@@ -5791,23 +5891,31 @@
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::navigationGestureWillEnd(bool willNavigate, WebBackForwardListItem&amp; item)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     m_pageClient.navigationGestureWillEnd(willNavigate, item);
</span><span class="cx">     m_loaderClient-&gt;navigationGestureWillEnd(*this, willNavigate, item);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::navigationGestureDidEnd(bool willNavigate, WebBackForwardListItem&amp; item)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     m_pageClient.navigationGestureDidEnd(willNavigate, item);
</span><span class="cx">     m_loaderClient-&gt;navigationGestureDidEnd(*this, willNavigate, item);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::navigationGestureDidEnd()
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     m_pageClient.navigationGestureDidEnd();
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void WebPageProxy::willRecordNavigationSnapshot(WebBackForwardListItem&amp; item)
</span><span class="cx"> {
</span><ins>+    PageClientProtector protector(m_pageClient);
+
</ins><span class="cx">     m_pageClient.willRecordNavigationSnapshot(item);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebKit2UIProcesseflWebViewEflh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/UIProcess/efl/WebViewEfl.h (186886 => 186887)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/UIProcess/efl/WebViewEfl.h        2015-07-16 02:42:51 UTC (rev 186886)
+++ trunk/Source/WebKit2/UIProcess/efl/WebViewEfl.h        2015-07-16 04:03:11 UTC (rev 186887)
</span><span class="lines">@@ -90,6 +90,9 @@
</span><span class="cx">     virtual void didFinishLoadForMainFrame() override final { }
</span><span class="cx">     virtual void didSameDocumentNavigationForMainFrame(SameDocumentNavigationType) override final { }
</span><span class="cx"> 
</span><ins>+    virtual void refView() override final { }
+    virtual void derefView() override final { }
+
</ins><span class="cx"> private:
</span><span class="cx">     EwkView* m_ewkView;
</span><span class="cx">     bool m_hasRequestedFullScreen;
</span></span></pre></div>
<a id="trunkSourceWebKit2UIProcessiosPageClientImplIOSh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/UIProcess/ios/PageClientImplIOS.h (186886 => 186887)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/UIProcess/ios/PageClientImplIOS.h        2015-07-16 02:42:51 UTC (rev 186886)
+++ trunk/Source/WebKit2/UIProcess/ios/PageClientImplIOS.h        2015-07-16 04:03:11 UTC (rev 186887)
</span><span class="lines">@@ -186,6 +186,9 @@
</span><span class="cx"> 
</span><span class="cx">     virtual void didChangeBackgroundColor() override;
</span><span class="cx"> 
</span><ins>+    virtual void refView() override;
+    virtual void derefView() override;
+
</ins><span class="cx">     WKContentView *m_contentView;
</span><span class="cx">     WKWebView *m_webView;
</span><span class="cx">     WKView *m_wkView;
</span></span></pre></div>
<a id="trunkSourceWebKit2UIProcessiosPageClientImplIOSmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/UIProcess/ios/PageClientImplIOS.mm (186886 => 186887)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/UIProcess/ios/PageClientImplIOS.mm        2015-07-16 02:42:51 UTC (rev 186886)
+++ trunk/Source/WebKit2/UIProcess/ios/PageClientImplIOS.mm        2015-07-16 04:03:11 UTC (rev 186887)
</span><span class="lines">@@ -739,6 +739,20 @@
</span><span class="cx">     [m_webView _updateScrollViewBackground];
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void PageClientImpl::refView()
+{
+    [m_contentView retain];
+    [m_webView retain];
+    [m_wkView retain];
+}
+
+void PageClientImpl::derefView()
+{
+    [m_contentView release];
+    [m_webView release];
+    [m_wkView release];
+}
+
</ins><span class="cx"> } // namespace WebKit
</span><span class="cx"> 
</span><span class="cx"> #endif // PLATFORM(IOS)
</span></span></pre></div>
<a id="trunkSourceWebKit2UIProcessmacPageClientImplh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/UIProcess/mac/PageClientImpl.h (186886 => 186887)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/UIProcess/mac/PageClientImpl.h        2015-07-16 02:42:51 UTC (rev 186886)
+++ trunk/Source/WebKit2/UIProcess/mac/PageClientImpl.h        2015-07-16 04:03:11 UTC (rev 186887)
</span><span class="lines">@@ -216,6 +216,9 @@
</span><span class="cx"> #if ENABLE(WIRELESS_PLAYBACK_TARGET)
</span><span class="cx">     virtual WebCore::WebMediaSessionManager&amp; mediaSessionManager() override;
</span><span class="cx"> #endif
</span><ins>+
+    virtual void refView() override;
+    virtual void derefView() override;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebKit
</span></span></pre></div>
<a id="trunkSourceWebKit2UIProcessmacPageClientImplmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/UIProcess/mac/PageClientImpl.mm (186886 => 186887)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/UIProcess/mac/PageClientImpl.mm        2015-07-16 02:42:51 UTC (rev 186886)
+++ trunk/Source/WebKit2/UIProcess/mac/PageClientImpl.mm        2015-07-16 04:03:11 UTC (rev 186887)
</span><span class="lines">@@ -836,6 +836,16 @@
</span><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><ins>+void PageClientImpl::refView()
+{
+    [m_wkView retain];
+}
+
+void PageClientImpl::derefView()
+{
+    [m_wkView release];
+}
+
</ins><span class="cx"> } // namespace WebKit
</span><span class="cx"> 
</span><span class="cx"> #endif // PLATFORM(MAC)
</span></span></pre>
</div>
</div>

</body>
</html>