Changeset 20090 in webkit
- Timestamp:
- Mar 9, 2007 8:05:37 AM (17 years ago)
- Location:
- trunk
- Files:
-
- 4 added
- 5 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r20088 r20090 1 2007-03-09 Mitz Pettel <mitz@webkit.org> 2 3 Reviewed by Darin. 4 5 - test for http://bugs.webkit.org/show_bug.cgi?id=9929 6 REGRESSION: crash on logging in on mijnpostbank.nl 7 8 * http/tests/misc/onload-remove-iframe-crash-2-expected.txt: Added. 9 * http/tests/misc/onload-remove-iframe-crash-2.html: Added. 10 * http/tests/misc/resources/onload-remove-iframe-crash-2.html: Added. 11 * http/tests/misc/resources/onload-remove-iframe.html: Added. 12 1 13 2007-03-08 Justin Garcia <justin.garcia@apple.com> 2 14 -
trunk/WebCore/ChangeLog
r20089 r20090 1 2007-03-09 Mitz Pettel <mitz@webkit.org> 2 3 Reviewed by Darin. 4 5 - fix http://bugs.webkit.org/show_bug.cgi?id=9929 6 REGRESSION: crash on logging in on mijnpostbank.nl 7 8 Test: http/tests/misc/onload-remove-iframe-crash-2.html 9 10 The resulted from an iframe's load event handler removing the iframe 11 from the document. 12 13 * dom/Document.cpp: 14 (WebCore::Document::implicitClose): Bail out early if an event handler 15 removed the frame. 16 * loader/FrameLoader.cpp: 17 (WebCore::FrameLoader::FrameLoader): 18 (WebCore::FrameLoader::clear): 19 (WebCore::FrameLoader::checkCompleted): Protect the frame from deletion 20 by event handlers. 21 (WebCore::FrameLoader::checkCompletedTimerFired): 22 (WebCore::FrameLoader::scheduleCheckCompleted): 23 (WebCore::FrameLoader::detachFromParent): Schedule a completion check 24 on the parent (in case the child is what has been keeping it from completing). 25 * loader/FrameLoader.h: 26 1 27 2007-03-08 David Kilzer <ddkilzer@webkit.org> 2 28 -
trunk/WebCore/dom/Document.cpp
r20028 r20090 1390 1390 m_processingLoadEvent = false; 1391 1391 1392 // An event handler may have removed the frame 1393 if (!frame()) 1394 return; 1395 1392 1396 // Make sure both the initial layout and reflow happen after the onload 1393 1397 // fires. This will improve onload scores, and other browsers do it. 1394 1398 // If they wanna cheat, we can too. -dwh 1395 1399 1396 if (frame() && frame()->loader()->isScheduledLocationChangePending() && elapsedTime() < cLayoutScheduleThreshold) {1400 if (frame()->loader()->isScheduledLocationChangePending() && elapsedTime() < cLayoutScheduleThreshold) { 1397 1401 // Just bail out. Before or during the onload we were shifted to another page. 1398 1402 // The old i-Bench suite does this. When this happens don't bother painting or laying out. … … 1401 1405 } 1402 1406 1403 if (frame()) 1404 frame()->loader()->checkEmitLoadEvent(); 1407 frame()->loader()->checkEmitLoadEvent(); 1405 1408 1406 1409 // Now do our painting/layout, but only if we aren't in a subframe or if we're in a subframe -
trunk/WebCore/loader/FrameLoader.cpp
r20046 r20090 224 224 , m_containsPlugIns(false) 225 225 , m_redirectionTimer(this, &FrameLoader::redirectionTimerFired) 226 , m_checkCompletedTimer(this, &FrameLoader::checkCompletedTimerFired) 226 227 , m_opener(0) 227 228 , m_openedByJavaScript(false) … … 743 744 m_scheduledRedirection.clear(); 744 745 746 m_checkCompletedTimer.stop(); 747 745 748 m_receivedData = false; 746 749 … … 1083 1086 m_isComplete = true; 1084 1087 1088 RefPtr<Frame> protect(m_frame); 1085 1089 checkEmitLoadEvent(); // if we didn't do it before 1086 1090 … … 1091 1095 1092 1096 completed(); 1097 } 1098 1099 void FrameLoader::checkCompletedTimerFired(Timer<FrameLoader>*) 1100 { 1101 checkCompleted(); 1102 } 1103 1104 void FrameLoader::scheduleCheckCompleted() 1105 { 1106 if (!m_checkCompletedTimer.isActive()) 1107 m_checkCompletedTimer.startOneShot(0); 1093 1108 } 1094 1109 … … 2842 2857 setDocumentLoader(0); 2843 2858 m_client->detachedFromParent3(); 2844 if (Frame* parent = m_frame->tree()->parent()) 2859 if (Frame* parent = m_frame->tree()->parent()) { 2845 2860 parent->tree()->removeChild(m_frame); 2846 else { 2861 parent->loader()->scheduleCheckCompleted(); 2862 } else { 2847 2863 m_frame->setView(0); 2848 2864 m_frame->pageDestroyed(); -
trunk/WebCore/loader/FrameLoader.h
r20027 r20090 83 83 struct WindowFeatures; 84 84 85 template <typename T> class Timer;86 87 85 bool isBackForwardLoadType(FrameLoadType); 88 86 … … 363 361 void finishedParsing(); 364 362 void checkCompleted(); 363 void scheduleCheckCompleted(); 365 364 366 365 void clearRecordedFormValues(); … … 436 435 437 436 void redirectionTimerFired(Timer<FrameLoader>*); 437 void checkCompletedTimerFired(Timer<FrameLoader>*); 438 438 439 439 void cancelRedirection(bool newLoadInProgress = false); … … 587 587 588 588 Timer<FrameLoader> m_redirectionTimer; 589 Timer<FrameLoader> m_checkCompletedTimer; 589 590 590 591 Frame* m_opener;
Note: See TracChangeset
for help on using the changeset viewer.