REGRESSION(283286.393@safari-7620-branch): Crash in PageOverlayController::uninstallPageOverlay

https://bugs.webkit.org/show_bug.cgi?id=283832
rdar://140529810

Reviewed by Chris Dumez.

283286.393@safari-7620-branch made the ResourceUsageOverlay destructor access the page it was holding
instead of the page held by the page’s mainframe. This was a behavior change because the page destructor
nulls the page held by the mainframe, so we would not try to uninstall the overlay if page destruction
has begun.

This change clears the page held by ResourceUsageOverlay in the page’s destructor to avoid uninstalling
the overlay during page destruction.

* Source/WebCore/page/Page.cpp:
(WebCore::Page::~Page):
* Source/WebCore/page/ResourceUsageOverlay.h:

Originally-landed-as: 283286.535@safari-7620-branch (6bfd37a). rdar://144654097
Canonical link: https://commits.webkit.org/290254@main

Author: charliewolfe

Source/WebCore/page/Page.cpp

@@ -539,6 +539,9 @@ Page::~Page()
     if (RefPtr scrollingCoordinator = m_scrollingCoordinator)
         scrollingCoordinator->pageDestroyed();
 
+    if (m_resourceUsageOverlay)
+        m_resourceUsageOverlay->detachFromPage();
+
     checkedBackForward()->close();
     if (!isUtilityPage())
         BackForwardCache::singleton().removeAllItemsForPage(*this);

Source/WebCore/page/ResourceUsageOverlay.h

@@ -63,6 +63,8 @@ class ResourceUsageOverlay final : public PageOverlayClient, public RefCounted<R
     void platformDraw(CGContextRef);
 #endif
 
+    void detachFromPage() { m_page.clear(); }
+
     static const int normalWidth = 570;
     static const int normalHeight = 180;