Changeset 35321 in webkit
- Timestamp:
- Jul 24, 2008 12:45:28 AM (16 years ago)
- Location:
- trunk
- Files:
-
- 2 added
- 4 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r35320 r35321 1 2008-07-23 Julien Chaffraix <jchaffraix@webkit.org> 2 3 Reviewed by Eric. 4 5 Test for bug 19588: CRASH doing open() on destroyed window 6 https://bugs.webkit.org/show_bug.cgi?id=19588 7 8 Test case from Eric Roman. 9 10 * fast/frames/crash-removed-iframe-expected.txt: Added. 11 * fast/frames/crash-removed-iframe.html: Added. 12 1 13 2008-07-23 Dan Bernstein <mitz@apple.com> 2 14 -
trunk/WebCore/ChangeLog
r35320 r35321 1 2008-07-23 Julien Chaffraix <jchaffraix@webkit.org> 2 3 Reviewed by Eric. 4 5 Bug 19588: CRASH doing open() on destroyed window 6 https://bugs.webkit.org/show_bug.cgi?id=19588 7 8 Add frame's page null check as it could have been 9 detached from the page. 10 11 Test: fast/frames/crash-removed-iframe.html 12 13 * bindings/js/JSDOMWindowBase.cpp: 14 (WebCore::windowProtoFuncOpen): 15 * page/FrameTree.cpp: 16 (WebCore::FrameTree::find): 17 1 18 2008-07-23 Dan Bernstein <mitz@apple.com> 2 19 -
trunk/WebCore/bindings/js/JSDOMWindowBase.cpp
r35291 r35321 1025 1025 WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2))); 1026 1026 FloatRect windowRect(windowFeatures.x, windowFeatures.y, windowFeatures.width, windowFeatures.height); 1027 DOMWindow::adjustWindowRect(screenAvailableRect(page ->mainFrame()->view()), windowRect, windowRect);1027 DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect); 1028 1028 1029 1029 windowFeatures.x = windowRect.x(); -
trunk/WebCore/page/FrameTree.cpp
r30840 r35321 164 164 165 165 if (name == "_top") 166 return m_thisFrame->page()->mainFrame();166 return top(); 167 167 168 168 if (name == "_parent") … … 180 180 // Search the entire tree for this page next. 181 181 Page* page = m_thisFrame->page(); 182 183 // The frame could have been detached from the page, so check it. 184 if (!page) 185 return 0; 186 182 187 for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) 183 188 if (frame->tree()->name() == name)
Note: See TracChangeset
for help on using the changeset viewer.