Commit ee9cb8ce authored by andersca's avatar andersca
Browse files

2006-07-08 Anders Carlsson <acarlsson@apple.com>

        Reviewed by Brady.

        http://bugzilla.opendarwin.org/show_bug.cgi?id=9777
        Reproducible crash in Loading/Frames in ToT.
        
        The problem was that the renderpart destructor resets the frame's 
        owner element. For iframes, this should only be done when the element is 
        going to be removed from the document.
        
        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::~HTMLIFrameElement):
        (WebCore::HTMLIFrameElement::willRemove):
        (WebCore::HTMLIFrameElement::removedFromDocument):
        (WebCore::HTMLIFrameElement::detach):        
        * html/HTMLIFrameElement.h:
        Remove the frame in willRemove instead.
        
        * rendering/RenderPart.cpp:
        (WebCore::RenderPart::RenderPart):
        (WebCore::RenderPart::~RenderPart):
        * rendering/RenderPart.h:
        Don't call setFrame(0) in the destructor when the element is an iframe element.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15219 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent ffcfdbfc
2006-07-08 Anders Carlsson <acarlsson@apple.com>
Reviewed by Brady.
http://bugzilla.opendarwin.org/show_bug.cgi?id=9777
Reproducible crash in Loading/Frames in ToT.
The problem was that the renderpart destructor resets the frame's
owner element. For iframes, this should only be done when the element is
going to be removed from the document.
* html/HTMLIFrameElement.cpp:
(WebCore::HTMLIFrameElement::~HTMLIFrameElement):
(WebCore::HTMLIFrameElement::willRemove):
(WebCore::HTMLIFrameElement::removedFromDocument):
(WebCore::HTMLIFrameElement::detach):
* html/HTMLIFrameElement.h:
Remove the frame in willRemove instead.
* rendering/RenderPart.cpp:
(WebCore::RenderPart::RenderPart):
(WebCore::RenderPart::~RenderPart):
* rendering/RenderPart.h:
Don't call setFrame(0) in the destructor when the element is an iframe element.
2006-07-07 Darin Adler <darin@apple.com>
Reviewed by Anders.
......
......@@ -48,12 +48,6 @@ HTMLIFrameElement::HTMLIFrameElement(Document* doc)
HTMLIFrameElement::~HTMLIFrameElement()
{
if (Frame* frame = contentFrame()) {
frame->disconnectOwnerElement();
frame->page()->decrementFrameCount();
frame->frameDetached();
ASSERT(!contentFrame());
}
}
bool HTMLIFrameElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
......@@ -114,20 +108,25 @@ void HTMLIFrameElement::insertedIntoDocument()
}
}
void HTMLIFrameElement::removedFromDocument()
void HTMLIFrameElement::willRemove()
{
if (document()->isHTMLDocument()) {
HTMLDocument *doc = static_cast<HTMLDocument *>(document());
doc->removeDocExtraNamedItem(oldNameAttr);
}
if (Frame* frame = contentFrame()) {
frame->disconnectOwnerElement();
frame->page()->decrementFrameCount();
frame->frameDetached();
ASSERT(!contentFrame());
}
HTMLElement::willRemove();
}
void HTMLIFrameElement::removedFromDocument()
{
if (document()->isHTMLDocument()) {
HTMLDocument *doc = static_cast<HTMLDocument *>(document());
doc->removeDocExtraNamedItem(oldNameAttr);
}
HTMLElement::removedFromDocument();
}
......@@ -161,11 +160,6 @@ void HTMLIFrameElement::attach()
void HTMLIFrameElement::detach()
{
RenderPartObject* renderPart = static_cast<RenderPartObject*>(renderer());
if (renderPart)
renderPart->setFrame(0);
HTMLElement::detach();
}
......
......@@ -44,7 +44,8 @@ public:
virtual void insertedIntoDocument();
virtual void removedFromDocument();
virtual void willRemove();
virtual void attach();
virtual void detach();
virtual bool rendererIsNeeded(RenderStyle*);
......
......@@ -40,6 +40,7 @@ using namespace HTMLNames;
RenderPart::RenderPart(HTMLElement* node)
: RenderWidget(node)
, m_frame(0)
, m_disconnectOwnerElementWhenDestroyed(!node->hasTagName(iframeTag))
{
// init RenderObject attributes
setInline(false);
......@@ -56,7 +57,8 @@ RenderPart::~RenderPart()
else
delete widget;
setFrame(0);
if (m_disconnectOwnerElementWhenDestroyed)
setFrame(0);
}
void RenderPart::setFrame(Frame* frame)
......
......@@ -57,6 +57,7 @@ private:
virtual void deleteWidget();
Frame* m_frame;
bool m_disconnectOwnerElementWhenDestroyed;
};
}
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment