2006-10-07 Andrew Wellington <proton@wiretapped.net>

        Reviewed by Eric.

        Bug 10837: REGRESSION: Yahoo New Charts Crashes WebKit
        http://bugzilla.opendarwin.org/show_bug.cgi?id=10837

        Return null when there is no frame. This matches Firefox.

        * bindings/js/kjs_html.cpp:
        (KJS::JSHTMLDocument::getValueProperty):

2006-10-07  Andrew Wellington  <proton@wiretapped.net>

        Reviewed by Eric.

        Test for http://bugzilla.opendarwin.org/show_bug.cgi?id=10837
        Bug 10837: REGRESSION: Yahoo New Charts Crashes WebKit

        * fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.checksum: Added.
        * fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.png: Added.
        * fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.txt: Added.
        * fast/dom/HTMLDocument/frameless-location-bugzilla10837.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@16881 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index b2547de5a29968f3b8f93794f2c1a961d574e497..3a55a7f4f43c767d645a1241968013adf423adc1 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2006-10-07  Andrew Wellington  <proton@wiretapped.net>
+
+        Reviewed by Eric.
+
+        Test for http://bugzilla.opendarwin.org/show_bug.cgi?id=10837
+        Bug 10837: REGRESSION: Yahoo New Charts Crashes WebKit
+
+        * fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.checksum: Added.
+        * fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.png: Added.
+        * fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.txt: Added.
+        * fast/dom/HTMLDocument/frameless-location-bugzilla10837.html: Added.
+
 2006-10-05  Alexey Proskuryakov  <ap@nypop.com>
 
         Reviewed by Darin.

diff --git a/LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.checksum b/LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.checksum
new file mode 100644 (file)
index 0000000..d627c38
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.checksum
@@ -0,0 +1 @@
+c07a88de7552db9f0a9b1c21643f8c52
\ No newline at end of file

diff --git a/LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.png b/LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.png
new file mode 100644 (file)
index 0000000..c6eeba6
Binary files /dev/null and b/LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.png differ

diff --git a/LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.txt b/LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.txt
new file mode 100644 (file)
index 0000000..38c892f
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.txt
@@ -0,0 +1,20 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderFrameSet {FRAMESET} at (0,0) size 800x600
+      RenderFrame {FRAME} at (0,0) size 398x600
+        layer at (0,0) size 396x596
+          RenderView at (0,0) size 396x596
+        layer at (0,0) size 396x596
+          RenderBlock {HTML} at (0,0) size 396x596
+            RenderBody {BODY} at (8,8) size 380x580
+              RenderBlock {DIV} at (0,0) size 380x18
+                RenderText {#text} at (0,0) size 61x18
+                  text run at (0,0) width 61: "PASSED"
+      RenderFrame {FRAME} at (402,0) size 398x600
+        layer at (0,0) size 396x596
+          RenderView at (0,0) size 396x596
+        layer at (0,0) size 396x8
+          RenderBlock {HTML} at (0,0) size 396x8
+            RenderBody {BODY} at (8,8) size 380x0

diff --git a/LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837.html b/LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837.html
new file mode 100644 (file)
index 0000000..d3dd4bb
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837.html
@@ -0,0 +1,15 @@
+<frameset cols="1,1">
+    <frame src="data:text/html,
+        <div id='result'>
+        FAILED
+        </div>
+        <script>
+            var f = parent.frames[1];
+            var d = f.document;
+            f.location = 'data:text/html,foo';
+            var test = d.location;
+            document.getElementById('result').innerHTML = 'PASSED';
+        </script>
+    ">
+    <frame src="about:blank">
+</frameset>

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 586900841b92fb898a6ee8c3155562bf4f05fd50..95b480d371b003b670e8e5d41980a67d67b0b9a0 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2006-10-07  Andrew Wellington  <proton@wiretapped.net>
+
+        Reviewed by Eric.
+
+        Bug 10837: REGRESSION: Yahoo New Charts Crashes WebKit
+        http://bugzilla.opendarwin.org/show_bug.cgi?id=10837
+
+        Return null when there is no frame. This matches Firefox.
+
+        * bindings/js/kjs_html.cpp:
+        (KJS::JSHTMLDocument::getValueProperty):
+
 2006-10-07  David Hyatt  <hyatt@apple.com>
 
         Implement scroll corner painting (a white rect fill) for overflow areas to cover up

diff --git a/WebCore/bindings/js/kjs_html.cpp b/WebCore/bindings/js/kjs_html.cpp
index b70f0d109c25c671b7292d6b5973eb702868eca7..38293bdcc24a420373f9c838fd890390a7e1a887 100644 (file)
--- a/WebCore/bindings/js/kjs_html.cpp
+++ b/WebCore/bindings/js/kjs_html.cpp
@@ -251,6 +251,8 @@ JSValue *JSHTMLDocument::getValueProperty(ExecState* exec, int token) const
   case Body:
     return toJS(exec, body);
   case Location:
+    if (!frame)
+      return jsNull();
     if (Window* win = Window::retrieveWindow(frame))
       return win->location();
     return jsUndefined();