2006-07-08 Anders Carlsson <acarlsson@apple.com>
authorandersca <andersca@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 7 Jul 2006 23:46:22 +0000 (23:46 +0000)
committerandersca <andersca@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 7 Jul 2006 23:46:22 +0000 (23:46 +0000)
commitf0301c86ed87f3e7a5346d4433292489cae0c544
tree172bea42f25d27f211e4b358bb6c82dcaeb77b66
parentba7d890f8a5d4618113da45a4340359d65a81a3e
2006-07-08  Anders Carlsson  <acarlsson@apple.com>

        Reviewed by Brady.

        http://bugzilla.opendarwin.org/show_bug.cgi?id=9777
        Reproducible crash in Loading/Frames in ToT.

        The problem was that the renderpart destructor resets the frame's
        owner element. For iframes, this should only be done when the element is
        going to be removed from the document.

        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::~HTMLIFrameElement):
        (WebCore::HTMLIFrameElement::willRemove):
        (WebCore::HTMLIFrameElement::removedFromDocument):
        (WebCore::HTMLIFrameElement::detach):
        * html/HTMLIFrameElement.h:
        Remove the frame in willRemove instead.

        * rendering/RenderPart.cpp:
        (WebCore::RenderPart::RenderPart):
        (WebCore::RenderPart::~RenderPart):
        * rendering/RenderPart.h:
        Don't call setFrame(0) in the destructor when the element is an iframe element.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@15219 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebCore/ChangeLog
WebCore/html/HTMLIFrameElement.cpp
WebCore/html/HTMLIFrameElement.h
WebCore/rendering/RenderPart.cpp
WebCore/rendering/RenderPart.h