fix race condition in WebViewClassic.destroy()

    Bug: 6088940

Change-Id: If2cf26d4aab73d2d8689e4e3f9ec8e91193c966d

3 files changed, 12 insertions, 10 deletions

diff --git a/core/java/android/webkit/CallbackProxy.java b/core/java/android/webkit/CallbackProxy.java
index 484c449639a8..2afb841b34ab 100644
--- a/core/java/android/webkit/CallbackProxy.java
+++ b/core/java/android/webkit/CallbackProxy.java
@@ -155,6 +155,12 @@ class CallbackProxy extends Handler {
         mBackForwardList = new WebBackForwardList(this);
     }
 
+    protected void shutdown() {
+        setWebViewClient(null);
+        setWebChromeClient(null);
+        removeCallbacksAndMessages(null);
+    }
+
     /**
      * Set the WebViewClient.
      * @param client An implementation of WebViewClient.
diff --git a/core/java/android/webkit/WebViewClassic.java b/core/java/android/webkit/WebViewClassic.java
index 76fc8f4d0878..6c607f6eeeaa 100644
--- a/core/java/android/webkit/WebViewClassic.java
+++ b/core/java/android/webkit/WebViewClassic.java
@@ -2121,10 +2121,6 @@ public final class WebViewClassic implements WebViewProvider, WebViewProvider.Sc
         }
         if (mNativeClass != 0) nativeStopGL();
         if (mWebViewCore != null) {
-            // Set the handlers to null before destroying WebViewCore so no
-            // more messages will be posted.
-            mCallbackProxy.setWebViewClient(null);
-            mCallbackProxy.setWebChromeClient(null);
             // Tell WebViewCore to destroy itself
             synchronized (this) {
                 WebViewCore webViewCore = mWebViewCore;
@@ -2133,12 +2129,6 @@ public final class WebViewClassic implements WebViewProvider, WebViewProvider.Sc
             }
             // Remove any pending messages that might not be serviced yet.
             mPrivateHandler.removeCallbacksAndMessages(null);
-            mCallbackProxy.removeCallbacksAndMessages(null);
-            // Wake up the WebCore thread just in case it is waiting for a
-            // JavaScript dialog.
-            synchronized (mCallbackProxy) {
-                mCallbackProxy.notify();
-            }
         }
         if (mNativeClass != 0) {
             nativeDestroy();
diff --git a/core/java/android/webkit/WebViewCore.java b/core/java/android/webkit/WebViewCore.java
index 4bda5efe242a..bcfa9e273b8c 100644
--- a/core/java/android/webkit/WebViewCore.java
+++ b/core/java/android/webkit/WebViewCore.java
@@ -1252,6 +1252,12 @@ public final class WebViewCore {
                             // Time to take down the world. Cancel all pending
                             // loads and destroy the native view and frame.
                             synchronized (WebViewCore.this) {
+                                mCallbackProxy.shutdown();
+                                // Wake up the WebCore thread just in case it is waiting for a
+                                // JavaScript dialog.
+                                synchronized (mCallbackProxy) {
+                                    mCallbackProxy.notify();
+                                }
                                 mBrowserFrame.destroy();
                                 mBrowserFrame = null;
                                 mSettings.onDestroyed();