2007-08-23 Mitz Pettel <mitz@webkit.org>

        Reviewed by Darin.

        - fix http://bugs.webkit.org/show_bug.cgi?id=14899
          !d->m_view->needsLayout() in Frame::paint() (Causes assert)

        WebKit copies the width and height attributes of an <embed> to its
        nearest <object> ancestor. This used to be done in updateWidget(), but
        that could lead to the document being dirty right after layout and
        before painting. The patch moves the copying of the attributes to when
        the <embed> is inserted into the document or its attributes change.

        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::insertedIntoDocument):
        (WebCore::HTMLEmbedElement::attributeChanged):
        * html/HTMLEmbedElement.h:
        * manual-tests/bugzilla-14899.html: Added.
        * rendering/RenderPartObject.cpp:
        (WebCore::RenderPartObject::updateWidget):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@25197 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index a4b59357289f91c533d528ecf6fd45f52a5fb41e..f008b71f4f5cb3b3bda95bbbcd5a56663f7d5e72 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,24 @@
+2007-08-23  Mitz Pettel  <mitz@webkit.org>
+
+        Reviewed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=14899
+          !d->m_view->needsLayout() in Frame::paint() (Causes assert)
+
+        WebKit copies the width and height attributes of an <embed> to its
+        nearest <object> ancestor. This used to be done in updateWidget(), but
+        that could lead to the document being dirty right after layout and
+        before painting. The patch moves the copying of the attributes to when
+        the <embed> is inserted into the document or its attributes change.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::insertedIntoDocument):
+        (WebCore::HTMLEmbedElement::attributeChanged):
+        * html/HTMLEmbedElement.h:
+        * manual-tests/bugzilla-14899.html: Added.
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget):
+
 2007-08-22  Anders Carlsson  <andersca@apple.com>
 
         Reviewed by Darin and Oliver.

diff --git a/WebCore/html/HTMLEmbedElement.cpp b/WebCore/html/HTMLEmbedElement.cpp
index 3af6a689d01ed6fb96d52de5b262b27bfcc876ea..5851deb49f4711dd77e2f7a08991decd287e28fe 100644 (file)
--- a/WebCore/html/HTMLEmbedElement.cpp
+++ b/WebCore/html/HTMLEmbedElement.cpp
@@ -30,6 +30,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "HTMLDocument.h"
+#include "HTMLObjectElement.h"
 #include "HTMLNames.h"
 #include "RenderPartObject.h"
 
@@ -173,6 +174,20 @@ void HTMLEmbedElement::insertedIntoDocument()
         doc->addNamedItem(oldNameAttr);
     }
 
+    String width = getAttribute(widthAttr);
+    String height = getAttribute(heightAttr);
+    if (!width.isEmpty() || !height.isEmpty()) {
+        Node* n = parent();
+        while (n && !n->hasTagName(objectTag))
+            n = n->parent();
+        if (n) {
+            if (!width.isEmpty())
+                static_cast<HTMLObjectElement*>(n)->setAttribute(widthAttr, width);
+            if (!height.isEmpty())
+                static_cast<HTMLObjectElement*>(n)->setAttribute(heightAttr, height);
+        }
+    }
+
     HTMLPlugInElement::insertedIntoDocument();
 }
 
@@ -186,6 +201,19 @@ void HTMLEmbedElement::removedFromDocument()
     HTMLPlugInElement::removedFromDocument();
 }
 
+void HTMLEmbedElement::attributeChanged(Attribute* attr, bool preserveDecls)
+{
+    HTMLPlugInElement::attributeChanged(attr, preserveDecls);
+
+    if ((attr->name() == widthAttr || attr->name() == heightAttr) && !attr->isEmpty()) {
+        Node* n = parent();
+        while (n && !n->hasTagName(objectTag))
+            n = n->parent();
+        if (n)
+            static_cast<HTMLObjectElement*>(n)->setAttribute(attr->name(), attr->value());
+    }
+}
+
 bool HTMLEmbedElement::isURLAttribute(Attribute *attr) const
 {
     return attr->name() == srcAttr;

diff --git a/WebCore/html/HTMLEmbedElement.h b/WebCore/html/HTMLEmbedElement.h
index 5c3a7a91711531ed43f04f5c24020bb8456dbdd2..67688649aec692249870cc0152d7d4b1e4df5638 100644 (file)
--- a/WebCore/html/HTMLEmbedElement.h
+++ b/WebCore/html/HTMLEmbedElement.h
@@ -52,6 +52,7 @@ public:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
+    virtual void attributeChanged(Attribute*, bool preserveDecls = false);
     
     virtual bool isURLAttribute(Attribute*) const;
 

diff --git a/WebCore/manual-tests/bugzilla-14899.html b/WebCore/manual-tests/bugzilla-14899.html
new file mode 100644 (file)
index 0000000..1cee31a
--- /dev/null
+++ b/WebCore/manual-tests/bugzilla-14899.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
+        "http://www.w3.org/TR/html4/strict.dtd">
+<html lang="en">
+<head>
+    <script>
+        function test()
+        {
+            document.getElementById("z").style.display='block';
+            open("data:text/html,SUCCESS");
+        }
+    </script>
+</head>
+<body>
+    <p><b>BUG ID:</b> <a href="http://bugs.webkit.org/show_bug.cgi?id=14899">Bugzilla bug 14899</a> !d->m_view->needsLayout() in Frame::paint() (Causes assert)</p>
+    
+    <p id="test" style="background-color:skyblue; padding:3px;"><b>STEPS TO TEST:</b> 
+    Make sure you are using a debug build of the Web Kit framework. Click the Test button below.
+    </p>
+    
+    <p id="success" style="background-color:palegreen; padding:3px;"><b>TEST PASS:</b> 
+    A new window will open.
+    </p>
+    
+    <p id="failure" style="background-color:#FF3300; padding:3px;"><b>TEST FAIL:</b>  
+    An assertion failure will occur.
+    </p>
+    <button onclick="test()">Test</button>
+    <div id="z" style="display: none;">
+        <object>
+            <embed width="40" src="resources/orange.mov" controller="false">
+        </object>
+    </div>
+</body>

diff --git a/WebCore/rendering/RenderPartObject.cpp b/WebCore/rendering/RenderPartObject.cpp
index 4dd956fbd78d1a750fdd17cec04cff7a5a0db188..1c976578f71c149b9330672dd7be6387e45bcd58 100644 (file)
--- a/WebCore/rendering/RenderPartObject.cpp
+++ b/WebCore/rendering/RenderPartObject.cpp
@@ -131,12 +131,6 @@ void RenderPartObject::updateWidget(bool onlyCreateNonPlugins)
       HTMLElement *embedOrObject;
       if (embed) {
           embedOrObject = (HTMLElement *)embed;
-          String attribute = embedOrObject->getAttribute(widthAttr);
-          if (!attribute.isEmpty())
-              o->setAttribute(widthAttr, attribute);
-          attribute = embedOrObject->getAttribute(heightAttr);
-          if (!attribute.isEmpty())
-              o->setAttribute(heightAttr, attribute);
           url = embed->url;
           serviceType = embed->m_serviceType;
       } else