Title: [91143] branches/chromium/782
- Revision
- 91143
- Author
- [email protected]
- Date
- 2011-07-15 19:11:37 -0700 (Fri, 15 Jul 2011)
Log Message
Merge 90936
BUG=88846
Review URL: http://codereview.chromium.org/7390020
Modified Paths
Added Paths
Diff
Modified: branches/chromium/782/LayoutTests/fast/events/form-iframe-target-before-load-crash.html (91142 => 91143)
--- branches/chromium/782/LayoutTests/fast/events/form-iframe-target-before-load-crash.html 2011-07-16 02:08:27 UTC (rev 91142)
+++ branches/chromium/782/LayoutTests/fast/events/form-iframe-target-before-load-crash.html 2011-07-16 02:11:37 UTC (rev 91143)
@@ -1,4 +1,5 @@
<html>
+ <script src=""
<body _onload_="runTest()">
<div id="console"></div>
<form id="form1" style="display:none" method="post" target="test" action=""
@@ -25,6 +26,7 @@
if (count == 2)
{
document.body.removeChild(document.getElementById('test'));
+ gc();
document.body.offsetTop;
}
}, true);
Copied: branches/chromium/782/LayoutTests/fast/events/form-iframe-target-before-load-crash2-expected.txt (from rev 90936, trunk/LayoutTests/fast/events/form-iframe-target-before-load-crash2-expected.txt) (0 => 91143)
--- branches/chromium/782/LayoutTests/fast/events/form-iframe-target-before-load-crash2-expected.txt (rev 0)
+++ branches/chromium/782/LayoutTests/fast/events/form-iframe-target-before-load-crash2-expected.txt 2011-07-16 02:11:37 UTC (rev 91143)
@@ -0,0 +1,2 @@
+PASS
+
Copied: branches/chromium/782/LayoutTests/fast/events/form-iframe-target-before-load-crash2.html (from rev 90936, trunk/LayoutTests/fast/events/form-iframe-target-before-load-crash2.html) (0 => 91143)
--- branches/chromium/782/LayoutTests/fast/events/form-iframe-target-before-load-crash2.html (rev 0)
+++ branches/chromium/782/LayoutTests/fast/events/form-iframe-target-before-load-crash2.html 2011-07-16 02:11:37 UTC (rev 91143)
@@ -0,0 +1,37 @@
+<html>
+ <script src=""
+ <body _onload_="runTest()">
+ <div id="console"></div>
+ <form id="form1" style="display:none" target="test" action=""
+ <script>
+ if (window.layoutTestController)
+ {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ }
+
+ function runTest()
+ {
+ document.getElementById('form1').submit();
+
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ document.getElementById('console').innerHTML = 'PASS';
+ }
+
+ count = 0;
+ document.addEventListener("beforeload", function(event) {
+ event.preventDefault();
+ count = count + 1;
+ if (count == 2)
+ {
+ document.body.removeChild(document.getElementById('test'));
+ gc();
+ document.body.offsetTop;
+ }
+ }, true);
+ </script>
+ <iframe id="test" src=""
+ </body>
+</html>
+
Modified: branches/chromium/782/Source/WebCore/loader/FrameLoader.cpp (91142 => 91143)
--- branches/chromium/782/Source/WebCore/loader/FrameLoader.cpp 2011-07-16 02:08:27 UTC (rev 91142)
+++ branches/chromium/782/Source/WebCore/loader/FrameLoader.cpp 2011-07-16 02:11:37 UTC (rev 91143)
@@ -1337,6 +1337,9 @@
void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHistory, bool lockBackForwardList,
PassRefPtr<Event> event, PassRefPtr<FormState> formState, ReferrerPolicy referrerPolicy)
{
+ // Protect frame from getting blown away inside dispatchBeforeLoadEvent in loadWithDocumentLoader.
+ RefPtr<Frame> protect(m_frame);
+
KURL url = ""
ASSERT(m_frame->document());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
