Title: [94125] branches/chromium/835
- Revision
- 94125
- Author
- cev...@google.com
- Date
- 2011-08-30 16:40:01 -0700 (Tue, 30 Aug 2011)
Log Message
Merge 94112
BUG=89330
Review URL: http://codereview.chromium.org/7776023
Modified Paths
Added Paths
Diff
Copied: branches/chromium/835/LayoutTests/fast/loader/_javascript_-url-iframe-crash-expected.txt (from rev 94112, trunk/LayoutTests/fast/loader/_javascript_-url-iframe-crash-expected.txt) (0 => 94125)
--- branches/chromium/835/LayoutTests/fast/loader/_javascript_-url-iframe-crash-expected.txt (rev 0)
+++ branches/chromium/835/LayoutTests/fast/loader/_javascript_-url-iframe-crash-expected.txt 2011-08-30 23:40:01 UTC (rev 94125)
@@ -0,0 +1,7 @@
+
+
+
+
+
+This test passes if it doesn't crash.
+
Copied: branches/chromium/835/LayoutTests/fast/loader/_javascript_-url-iframe-crash.html (from rev 94112, trunk/LayoutTests/fast/loader/_javascript_-url-iframe-crash.html) (0 => 94125)
--- branches/chromium/835/LayoutTests/fast/loader/_javascript_-url-iframe-crash.html (rev 0)
+++ branches/chromium/835/LayoutTests/fast/loader/_javascript_-url-iframe-crash.html 2011-08-30 23:40:01 UTC (rev 94125)
@@ -0,0 +1,9 @@
+<iframe src=""
+<a><summary><pre><pre><pre><pre><pre><iframe src=""
+
+<a>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+This test passes if it doesn't crash.
Modified: branches/chromium/835/Source/WebCore/loader/DocumentWriter.cpp (94124 => 94125)
--- branches/chromium/835/Source/WebCore/loader/DocumentWriter.cpp 2011-08-30 23:36:47 UTC (rev 94124)
+++ branches/chromium/835/Source/WebCore/loader/DocumentWriter.cpp 2011-08-30 23:40:01 UTC (rev 94125)
@@ -106,12 +106,17 @@
return DOMImplementation::createDocument(m_mimeType, m_frame, url, m_frame->inViewSourceMode());
}
-void DocumentWriter::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
+void DocumentWriter::begin(const KURL& urlReference, bool dispatch, SecurityOrigin* origin)
{
// We need to take a reference to the security origin because |clear|
// might destroy the document that owns it.
RefPtr<SecurityOrigin> forcedSecurityOrigin = origin;
+ // We grab a local copy of the URL because it's easy for callers to supply
+ // a URL that will be deallocated during the execution of this function.
+ // For example, see <https://bugs.webkit.org/show_bug.cgi?id=66360>.
+ KURL url = ""
+
// Create a new document before clearing the frame, because it may need to
// inherit an aliased security context.
RefPtr<Document> document = createDocument(url);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
