LayoutTests:

        Reviewed by Geoff and Oliver.

        Add test for <rdar://problem/5267870>
        Mangleme: Reproducible assertion failure in -[WebCoreFrameBridge installInFrame:]

        * http/tests/misc/embedCrasher-expected.txt: Added.
        * http/tests/misc/embedCrasher.html: Added.

WebCore:

        Reviewed by Geoff and Oliver.

        Fix for <rdar://problem/5267870>
        Mangleme: Reproducible assertion failure in -[WebCoreFrameBridge installInFrame:]

        - Change embed/plugin code path to detach the frame on willRemove instead of detach.
          This matches what frame and iframe do.

        Test: http/tests/misc/embedCrasher.html

        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::willRemove):
        * html/HTMLPlugInElement.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@25087 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 0121e3f25c6f9455c019c59678b0c5328529509e..bcc2d367176f50dabf51269b15d744c328e9c2d2 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2007-08-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff and Oliver.
+
+        Add test for <rdar://problem/5267870>
+        Mangleme: Reproducible assertion failure in -[WebCoreFrameBridge installInFrame:]
+
+        * http/tests/misc/embedCrasher-expected.txt: Added.
+        * http/tests/misc/embedCrasher.html: Added.
+
 2007-08-14  Adele Peterson  <adele@apple.com>
 
         Reviewed by Maciej.

diff --git a/LayoutTests/http/tests/misc/embedCrasher-expected.txt b/LayoutTests/http/tests/misc/embedCrasher-expected.txt
new file mode 100644 (file)
index 0000000..9aacadc
--- /dev/null
+++ b/LayoutTests/http/tests/misc/embedCrasher-expected.txt
@@ -0,0 +1,2 @@
+ALERT: PASS: If you see this and the test did not crash the test has passed. (rdar://problem/5267870)
+

diff --git a/LayoutTests/http/tests/misc/embedCrasher.html b/LayoutTests/http/tests/misc/embedCrasher.html
new file mode 100644 (file)
index 0000000..49b9f43
--- /dev/null
+++ b/LayoutTests/http/tests/misc/embedCrasher.html
@@ -0,0 +1,8 @@
+<embed src='doesnotexist'>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    alert("PASS: If you see this and the test did not crash the test has passed. (rdar://problem/5267870)");
+</script>
+<frameset>
+<frame>

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 947e8d39eca1e2d7ea5f207143fec4a2afa1952e..2cebc66b3273dfd34f76f2e4202a80a14437c624 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2007-08-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff and Oliver.
+
+        Fix for <rdar://problem/5267870>
+        Mangleme: Reproducible assertion failure in -[WebCoreFrameBridge installInFrame:]
+
+        - Change embed/plugin code path to detach the frame on willRemove instead of detach.
+          This matches what frame and iframe do.
+
+        Test: http/tests/misc/embedCrasher.html
+
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::willRemove):
+        * html/HTMLPlugInElement.h:
+
 2007-08-14  Adele Peterson  <adele@apple.com>
 
         Reviewed by Maciej.

diff --git a/WebCore/html/HTMLPlugInElement.cpp b/WebCore/html/HTMLPlugInElement.cpp
index 6f42a3960cc74f9ae4c27baba2e5ed66b9f3a7e7..8ce68a33a64a949a790d3aa40c95dfeac5d981fe 100644 (file)
--- a/WebCore/html/HTMLPlugInElement.cpp
+++ b/WebCore/html/HTMLPlugInElement.cpp
@@ -27,6 +27,7 @@
 #include "CSSPropertyNames.h"
 #include "Document.h"
 #include "Frame.h"
+#include "FrameLoader.h"
 #include "FrameTree.h"
 #include "HTMLNames.h"
 #include "Page.h"
@@ -150,15 +151,16 @@ bool HTMLPlugInElement::checkDTD(const Node* newChild)
     return newChild->hasTagName(paramTag) || HTMLFrameOwnerElement::checkDTD(newChild);
 }
 
-void HTMLPlugInElement::detach()
+void HTMLPlugInElement::willRemove()
 {
     if (Frame* parentFrame = document()->frame()) {
-        Frame* contentFrame = parentFrame->tree()->child(m_frameName);
-        if (contentFrame)
+        if (Frame* contentFrame = parentFrame->tree()->child(m_frameName)) {
             contentFrame->disconnectOwnerElement();
+            contentFrame->loader()->frameDetached();
+        }
     }
-    
-    HTMLFrameOwnerElement::detach();
+
+    HTMLFrameOwnerElement::willRemove();
 }
 
 void HTMLPlugInElement::defaultEventHandler(Event* event)

diff --git a/WebCore/html/HTMLPlugInElement.h b/WebCore/html/HTMLPlugInElement.h
index cb1894a6107ba000f9a6a1d18c42cd87d5f53065..6ea4d43ea6f24c639c2c1c1d39bdb614f5396734 100644 (file)
--- a/WebCore/html/HTMLPlugInElement.h
+++ b/WebCore/html/HTMLPlugInElement.h
@@ -45,8 +45,8 @@ public:
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
     virtual void parseMappedAttribute(MappedAttribute*);
 
-    virtual void detach();
-    
+    virtual void willRemove();
+
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
     virtual bool checkDTD(const Node* newChild);