From b2044da3f9f9ad74f0dffd5ae024e558f8a9a89a Mon Sep 17 00:00:00 2001
From: Patrick Scott <phanna@android.com>
Date: Wed, 16 Jun 2010 12:27:06 -0400
Subject: [PATCH] Do not merge: cherry-pick a fix for a npe.

Fix a monkey crash when the new WebView is destroyed.

Grab the WebViewCore immediately so that if the Tab is destroyed, we have the
old WebViewCore object and can return the BrowserFrame.

Bug: 2733004
Change-Id: I8cddf9c9d635fc8b50983e4813eadda26cf23348
---
 core/java/android/webkit/BrowserFrame.java  |  6 +-----
 core/java/android/webkit/CallbackProxy.java | 12 +++++++++---
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/core/java/android/webkit/BrowserFrame.java b/core/java/android/webkit/BrowserFrame.java
index 219a469c2de9b..a2c80f265c7d1 100644
--- a/core/java/android/webkit/BrowserFrame.java
+++ b/core/java/android/webkit/BrowserFrame.java
@@ -785,11 +785,7 @@ class BrowserFrame extends Handler {
      * @return The BrowserFrame object stored in the new WebView.
      */
     private BrowserFrame createWindow(boolean dialog, boolean userGesture) {
-        WebView w = mCallbackProxy.createWindow(dialog, userGesture);
-        if (w != null) {
-            return w.getWebViewCore().getBrowserFrame();
-        }
-        return null;
+        return mCallbackProxy.createWindow(dialog, userGesture);
     }
 
     /**
diff --git a/core/java/android/webkit/CallbackProxy.java b/core/java/android/webkit/CallbackProxy.java
index 0e0e032e74c0a..d65c1064d3233 100644
--- a/core/java/android/webkit/CallbackProxy.java
+++ b/core/java/android/webkit/CallbackProxy.java
@@ -1098,7 +1098,7 @@ class CallbackProxy extends Handler {
         }
     }
 
-    public WebView createWindow(boolean dialog, boolean userGesture) {
+    public BrowserFrame createWindow(boolean dialog, boolean userGesture) {
         // Do an unsynchronized quick check to avoid posting if no callback has
         // been set.
         if (mWebChromeClient == null) {
@@ -1122,9 +1122,15 @@ class CallbackProxy extends Handler {
 
         WebView w = transport.getWebView();
         if (w != null) {
-            w.getWebViewCore().initializeSubwindow();
+            WebViewCore core = w.getWebViewCore();
+            // If WebView.destroy() has been called, core may be null.  Skip
+            // initialization in that case and return null.
+            if (core != null) {
+                core.initializeSubwindow();
+                return core.getBrowserFrame();
+            }
         }
-        return w;
+        return null;
     }
 
     public void onRequestFocus() {