Commit 965a62f1 authored by mjs's avatar mjs
Browse files

Reviewed by Darin, tweaked slightly and landed by Maciej.

        http://bugzilla.opendarwin.org/show_bug.cgi?id=9787
        fast/frames tests failing (bad pointer to owner element) under MallocScribble
        
        * html/HTMLFrameElement.cpp:
        (WebCore::HTMLFrameElement::close):
        Disconnect the owner element of our frame.
        
        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::attach):
        Don't call setFrame here.
        
        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::detach):
        Disconnect the owner element of our frame.

        * html/HTMLPlugInElement.h:
        (WebCore::HTMLPlugInElement::setFrameName):        
        New function.
        
        * page/Frame.cpp:
        (WebCore::Frame::Frame):
        Don't call setFrame.
        
        (WebCore::Frame::~Frame):
        Null out the owner element.
        
        (WebCore::Frame::requestObject):
        When an object creates a child frame, assign it a name so it can be
        accessed from HTMLPlugInElement.
        
        * rendering/RenderPart.cpp:
        (WebCore::RenderPart::RenderPart):
        (WebCore::RenderPart::~RenderPart):
        * rendering/RenderPart.h:
        Get rid of setFrame.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15240 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 5d430f1f
2006-07-08 Anders Carlsson <acarlsson@apple.com>
Reviewed by Darin, tweaked slightly and landed by Maciej.
http://bugzilla.opendarwin.org/show_bug.cgi?id=9787
fast/frames tests failing (bad pointer to owner element) under MallocScribble
* html/HTMLFrameElement.cpp:
(WebCore::HTMLFrameElement::close):
Disconnect the owner element of our frame.
* html/HTMLIFrameElement.cpp:
(WebCore::HTMLIFrameElement::attach):
Don't call setFrame here.
* html/HTMLPlugInElement.cpp:
(WebCore::HTMLPlugInElement::detach):
Disconnect the owner element of our frame.
* html/HTMLPlugInElement.h:
(WebCore::HTMLPlugInElement::setFrameName):
New function.
* page/Frame.cpp:
(WebCore::Frame::Frame):
Don't call setFrame.
(WebCore::Frame::~Frame):
Null out the owner element.
(WebCore::Frame::requestObject):
When an object creates a child frame, assign it a name so it can be
accessed from HTMLPlugInElement.
* rendering/RenderPart.cpp:
(WebCore::RenderPart::RenderPart):
(WebCore::RenderPart::~RenderPart):
* rendering/RenderPart.h:
Get rid of setFrame.
2006-07-08 Darin Adler <darin@apple.com>
Reviewed by Geoff.
......
......@@ -230,6 +230,7 @@ void HTMLFrameElement::close()
{
Frame* frame = document()->frame();
if (renderer() && frame) {
frame->disconnectOwnerElement();
frame->page()->decrementFrameCount();
if (Frame* childFrame = frame->tree()->child(m_name))
childFrame->frameDetached();
......
......@@ -151,7 +151,6 @@ void HTMLIFrameElement::attach()
if (!contentFrame())
openURL();
renderPart->setFrame(contentFrame());
renderPart->setWidget(contentFrame()->view());
renderPart->updateWidget();
needWidgetUpdate = false;
......
......@@ -25,6 +25,9 @@
#include "HTMLPlugInElement.h"
#include "CSSPropertyNames.h"
#include "Document.h"
#include "Frame.h"
#include "FrameTree.h"
#include "HTMLNames.h"
namespace WebCore {
......@@ -117,4 +120,15 @@ bool HTMLPlugInElement::checkDTD(const Node* newChild)
return newChild->hasTagName(paramTag) || HTMLElement::checkDTD(newChild);
}
void HTMLPlugInElement::detach()
{
if (Frame* parentFrame = document()->frame()) {
Frame* contentFrame = parentFrame->tree()->child(m_frameName);
if (contentFrame)
contentFrame->disconnectOwnerElement();
}
HTMLElement::detach();
}
}
......@@ -43,6 +43,8 @@ public:
virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
virtual void parseMappedAttribute(MappedAttribute*);
virtual void detach();
virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
virtual bool checkDTD(const Node* newChild);
......@@ -61,13 +63,15 @@ public:
#if __APPLE__
virtual KJS::Bindings::Instance* getInstance() const = 0;
#endif
void setFrameName(const AtomicString& frameName) { m_frameName = frameName; }
protected:
String oldNameAttr;
#if __APPLE__
mutable RefPtr<KJS::Bindings::Instance> m_instance;
#endif
private:
AtomicString m_frameName;
};
}
......
......@@ -168,9 +168,6 @@ Frame::Frame(Page* page, Element* ownerElement)
#ifndef NDEBUG
++FrameCounter::count;
#endif
if (ownerRenderer())
ownerRenderer()->setFrame(this);
}
Frame::~Frame()
......@@ -206,11 +203,6 @@ Frame::~Frame()
for (HashSet<Frame*>::iterator it = openedBy.begin(); it != end; ++it)
(*it)->setOpener(0);
if (ownerRenderer()) {
ownerRenderer()->setFrame(0);
ASSERT(!d->m_ownerElement);
}
if (d->m_view) {
d->m_view->hide();
d->m_view->m_frame = 0;
......@@ -1425,8 +1417,12 @@ bool Frame::requestObject(RenderPart* renderer, const String& url, const AtomicS
if (shouldUsePlugin(renderer->element(), completedURL, mimeType, renderer->hasFallbackContent(), useFallback))
return loadPlugin(renderer, completedURL, mimeType, paramNames, paramValues, useFallback);
ASSERT(renderer->node()->hasTagName(objectTag) || renderer->node()->hasTagName(embedTag));
AtomicString uniqueFrameName = tree()->uniqueChildName(frameName);
static_cast<HTMLPlugInElement*>(renderer->node())->setFrameName(uniqueFrameName);
// FIXME: ok to always make a new one? when does the old frame get removed?
return loadSubframe(static_cast<Element*>(renderer->element()), completedURL, frameName, d->m_referrer);
return loadSubframe(static_cast<Element*>(renderer->node()), completedURL, uniqueFrameName, d->m_referrer);
}
bool Frame::shouldUsePlugin(Node* element, const KURL& url, const String& mimeType, bool hasFallback, bool& useFallback)
......
......@@ -39,8 +39,6 @@ using namespace HTMLNames;
RenderPart::RenderPart(HTMLElement* node)
: RenderWidget(node)
, m_frame(0)
, m_disconnectOwnerElementWhenDestroyed(!node->hasTagName(iframeTag))
{
// init RenderObject attributes
setInline(false);
......@@ -56,19 +54,6 @@ RenderPart::~RenderPart()
static_cast<FrameView*>(widget)->deref();
else
delete widget;
if (m_disconnectOwnerElementWhenDestroyed)
setFrame(0);
}
void RenderPart::setFrame(Frame* frame)
{
if (frame == m_frame)
return;
if (m_frame)
m_frame->disconnectOwnerElement();
m_frame = frame;
}
void RenderPart::setWidget(Widget* widget)
......
......@@ -39,7 +39,6 @@ public:
virtual const char* renderName() const { return "RenderPart"; }
void setFrame(Frame*);
void setWidget(Widget*);
// FIXME: This should not be necessary.
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment