Changeset 75293 in webkit

Timestamp:

Jan 7, 2011 4:49:52 PM (13 years ago)

Author:

rniwa@webkit.org

Message:

2011-01-07 Ryosuke Niwa <​rniwa@webkit.org>

Reviewed by Ojan Vafai.

Adopting an iframe to a child frame results in stack overflow
​https://bugs.webkit.org/show_bug.cgi?id=52018

Throws an exception when a document adopts an iframe that is an ancestor
of the document in the frame hierarchy. New behavior matches that of Firefox.

Test: fast/html/adopt-parent-frame.html

• dom/Document.cpp: (WebCore::Document::adoptNode):

2011-01-07 Ryosuke Niwa <​rniwa@webkit.org>

Reviewed by Ojan Vafai.

Adopting an iframe to a child frame results in stack overflow
​https://bugs.webkit.org/show_bug.cgi?id=52018

Added a test to ensure calling adoptNode with an iframe throws an exception
if the adoptee is an ancestor of the document adopting the node in the frame hierarchy.

• fast/html/adopt-parent-frame-expected.txt: Added.
• fast/html/adopt-parent-frame.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/html/adopt-parent-frame-expected.txt (added)
• LayoutTests/fast/html/adopt-parent-frame.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/dom/Document.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-01-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Ojan Vafai.
+
+        Adopting an iframe to a child frame results in stack overflow
+        https://bugs.webkit.org/show_bug.cgi?id=52018
+
+        Added a test to ensure calling adoptNode with an iframe throws an exception
+        if the adoptee is an ancestor of the document adopting the node in the frame hierarchy.
+
+        * fast/html/adopt-parent-frame-expected.txt: Added.
+        * fast/html/adopt-parent-frame.html: Added.
+
 2011-01-07  Martin Robinson  <mrobinson@igalia.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2011-01-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Ojan Vafai.
+
+        Adopting an iframe to a child frame results in stack overflow
+        https://bugs.webkit.org/show_bug.cgi?id=52018
+
+        Throws an exception when a document adopts an iframe that is an ancestor
+        of the document in the frame hierarchy. New behavior matches that of Firefox.
+
+        Test: fast/html/adopt-parent-frame.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::adoptNode):
+
 2011-01-07  Mihai Parparita  <mihaip@chromium.org>
 

trunk/WebCore/dom/Document.cpp

@@ -898 +898 @@
     }       
     default:
-        if (source->hasTagName(iframeTag))
-            static_cast<HTMLIFrameElement*>(source.get())->setRemainsAliveOnRemovalFromTree(attached() && source->attached());
+        if (source->hasTagName(iframeTag)) {
+            HTMLIFrameElement* iframe = static_cast<HTMLIFrameElement*>(source.get());
+            if (frame()->tree()->isDescendantOf(iframe->contentFrame())) {
+                ec = HIERARCHY_REQUEST_ERR;
+                return 0;
+            }
+            iframe->setRemainsAliveOnRemovalFromTree(attached() && source->attached());
+        }
 
         if (source->parentNode())