Changeset 18965 in webkit

Timestamp:

Jan 18, 2007 5:03:05 PM (17 years ago)

Author:

bdash

Message:

2007-01-18 Mitz Pettel <​mitz@webkit.org>

Reviewed by Darin.

• fix ​http://bugs.webkit.org/show_bug.cgi?id=9952 REGRESSION: Repro crash when dragging an image from the window to the address bar

• page/FrameView.cpp: (WebCore::FrameView::~FrameView): Removed the call to Document::detach(). If this view is the current view, then the Frame should have already detached the document. Added an assertion that this is the case. If this view is not the current view, then it cannot access its document, but the page cache should have detached it already. Similarly, changed to call RenderPart::setWidget() only if this is the current view in the frame. (WebCore::FrameView::adjustViewSize): Added an assertion that this view is the current view in the frame. (WebCore::FrameView::layout): Ditto. (WebCore::FrameView::scheduleRelayout): Ditto. (WebCore::FrameView::scheduleRelayoutOfSubtree): Ditto. (WebCore::FrameView::windowClipRect): Ditto.

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/FrameView.cpp (modified) (6 diffs)

trunk/WebCore/ChangeLog

@@ +1 @@
+2007-01-18  Mitz Pettel  <mitz@webkit.org>
+
+        Reviewed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=9952
+          REGRESSION: Repro crash when dragging an image from the window to the address bar
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::~FrameView): Removed the call to Document::detach(). If this
+        view is the current view, then the Frame should have already detached the document.
+        Added an assertion that this is the case. If this view is not the current view,
+        then it cannot access its document, but the page cache should have detached it already.
+        Similarly, changed to call RenderPart::setWidget() only if this is the current view
+        in the frame.
+        (WebCore::FrameView::adjustViewSize): Added an assertion that this view is the current
+        view in the frame.
+        (WebCore::FrameView::layout): Ditto.
+        (WebCore::FrameView::scheduleRelayout): Ditto.
+        (WebCore::FrameView::scheduleRelayoutOfSubtree): Ditto.
+        (WebCore::FrameView::windowClipRect): Ditto.
+
 2007-01-18  Eric Seidel  <eric@webkit.org>
 

trunk/WebCore/page/FrameView.cpp

@@ -133 +133 @@
 
     if (m_frame) {
-        // FIXME: Is this really the right place to call detach on the document?
-        if (Document* doc = m_frame->document())
-            doc->detach();
-        if (RenderPart* renderer = m_frame->ownerRenderer())
+        ASSERT(m_frame->view() != this || !m_frame->document() || !m_frame->document()->renderer());
+        RenderPart* renderer = m_frame->ownerRenderer();
+        if (renderer && renderer->widget() == this)
             renderer->setWidget(0);
     }
@@ -216 +215 @@
 void FrameView::adjustViewSize()
 {
-    if (m_frame->document()) {
-        Document* document = m_frame->document();
-
+    ASSERT(m_frame->view() == this);
+    if (Document* document = m_frame->document()) {
         RenderView* root = static_cast<RenderView*>(document->renderer());
         if (!root)
@@ -311 +309 @@
 
     bool subtree = d->layoutRoot;
+
+    ASSERT(m_frame->view() == this);
+
     Document* document = m_frame->document();
     if (!document) {
@@ -635 +636 @@
 void FrameView::scheduleRelayout()
 {
+    ASSERT(m_frame->view() == this);
+
     if (d->layoutRoot) {
         if (d->layoutRoot->renderer())
@@ -664 +667 @@
 void FrameView::scheduleRelayoutOfSubtree(Node* n)
 {
+    ASSERT(m_frame->view() == this);
+
     if (!d->layoutSchedulingEnabled || (m_frame->document()
             && m_frame->document()->renderer()
@@ -811 +816 @@
 IntRect FrameView::windowClipRect(bool clipToContents) const
 {
+    ASSERT(m_frame->view() == this);
+
     // Set our clip rect to be our contents.
     IntRect clipRect;