Reviewed by Darin, tweaked slightly and landed by Maciej.
authormjs <mjs@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 9 Jul 2006 04:28:39 +0000 (04:28 +0000)
committermjs <mjs@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 9 Jul 2006 04:28:39 +0000 (04:28 +0000)
        http://bugzilla.opendarwin.org/show_bug.cgi?id=9787
        fast/frames tests failing (bad pointer to owner element) under MallocScribble

        * html/HTMLFrameElement.cpp:
        (WebCore::HTMLFrameElement::close):
        Disconnect the owner element of our frame.

        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::attach):
        Don't call setFrame here.

        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::detach):
        Disconnect the owner element of our frame.

        * html/HTMLPlugInElement.h:
        (WebCore::HTMLPlugInElement::setFrameName):
        New function.

        * page/Frame.cpp:
        (WebCore::Frame::Frame):
        Don't call setFrame.

        (WebCore::Frame::~Frame):
        Null out the owner element.

        (WebCore::Frame::requestObject):
        When an object creates a child frame, assign it a name so it can be
        accessed from HTMLPlugInElement.

        * rendering/RenderPart.cpp:
        (WebCore::RenderPart::RenderPart):
        (WebCore::RenderPart::~RenderPart):
        * rendering/RenderPart.h:
        Get rid of setFrame.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@15240 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore/ChangeLog
WebCore/html/HTMLFrameElement.cpp
WebCore/html/HTMLIFrameElement.cpp
WebCore/html/HTMLPlugInElement.cpp
WebCore/html/HTMLPlugInElement.h
WebCore/page/Frame.cpp
WebCore/rendering/RenderPart.cpp
WebCore/rendering/RenderPart.h

index cf5cbbf6d023ac0f47d9359209758d24336e3e42..45f51d4e1446a359677a536de51038562824d4eb 100644 (file)
@@ -1,3 +1,43 @@
+2006-07-08  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Darin, tweaked slightly and landed by Maciej.
+
+        http://bugzilla.opendarwin.org/show_bug.cgi?id=9787
+        fast/frames tests failing (bad pointer to owner element) under MallocScribble
+        
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::close):
+        Disconnect the owner element of our frame.
+        
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::attach):
+        Don't call setFrame here.
+        
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::detach):
+        Disconnect the owner element of our frame.
+
+        * html/HTMLPlugInElement.h:
+        (WebCore::HTMLPlugInElement::setFrameName):        
+        New function.
+        
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        Don't call setFrame.
+        
+        (WebCore::Frame::~Frame):
+        Null out the owner element.
+        
+        (WebCore::Frame::requestObject):
+        When an object creates a child frame, assign it a name so it can be
+        accessed from HTMLPlugInElement.
+        
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::RenderPart):
+        (WebCore::RenderPart::~RenderPart):
+        * rendering/RenderPart.h:
+        Get rid of setFrame.
+
 2006-07-08  Darin Adler  <darin@apple.com>
 
         Reviewed by Geoff.
index 08657ce27929b0e3981cb9cc7c31de5927cc3df6..1aaff3a0ea4783e0eda901d2da39e7c2c4d3bafd 100644 (file)
@@ -230,6 +230,7 @@ void HTMLFrameElement::close()
 {
     Frame* frame = document()->frame();
     if (renderer() && frame) {
+        frame->disconnectOwnerElement();
         frame->page()->decrementFrameCount();
         if (Frame* childFrame = frame->tree()->child(m_name))
             childFrame->frameDetached();
index 8ac888359944c0500051ec41516613805fd7f0d0..31006359718ab89054e9b8b1348630ca859a490d 100644 (file)
@@ -151,7 +151,6 @@ void HTMLIFrameElement::attach()
         if (!contentFrame())
             openURL();
         
-        renderPart->setFrame(contentFrame());
         renderPart->setWidget(contentFrame()->view());
         renderPart->updateWidget();
         needWidgetUpdate = false;
index d282b40ac86f9d52d1c571c13adb48af1c48c6a4..d30db648bccbba4b594295c95bfa8bbc5a9f1701 100644 (file)
@@ -25,6 +25,9 @@
 #include "HTMLPlugInElement.h"
 
 #include "CSSPropertyNames.h"
+#include "Document.h"
+#include "Frame.h"
+#include "FrameTree.h"
 #include "HTMLNames.h"
 
 namespace WebCore {
@@ -117,4 +120,15 @@ bool HTMLPlugInElement::checkDTD(const Node* newChild)
     return newChild->hasTagName(paramTag) || HTMLElement::checkDTD(newChild);
 }
 
+void HTMLPlugInElement::detach()
+{
+    if (Frame* parentFrame = document()->frame()) {
+        Frame* contentFrame = parentFrame->tree()->child(m_frameName);
+        if (contentFrame)
+            contentFrame->disconnectOwnerElement();
+    }
+    
+    HTMLElement::detach();
+}
+
 }
index 98ad92c5e65beb08dc854d18e59a9298fa5e085c..76a3ac2214167dcd0c22baa9489ebdc41a452a13 100644 (file)
@@ -43,6 +43,8 @@ public:
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
     virtual void parseMappedAttribute(MappedAttribute*);
 
+    virtual void detach();
+    
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
     virtual bool checkDTD(const Node* newChild);
 
@@ -61,13 +63,15 @@ public:
 #if __APPLE__
     virtual KJS::Bindings::Instance* getInstance() const = 0;
 #endif
-    
+
+    void setFrameName(const AtomicString& frameName) { m_frameName = frameName; }
 protected:
     String oldNameAttr;
-
 #if __APPLE__
     mutable RefPtr<KJS::Bindings::Instance> m_instance;
 #endif
+private:
+    AtomicString m_frameName;
 };
 
 }
index 2c116501469b8a480293a09d7f5cce482d2a1186..dd70281cb08adbbff253d2506f7fc54a1e3be587 100644 (file)
@@ -168,9 +168,6 @@ Frame::Frame(Page* page, Element* ownerElement)
 #ifndef NDEBUG
     ++FrameCounter::count;
 #endif
-
-    if (ownerRenderer())
-        ownerRenderer()->setFrame(this);
 }
 
 Frame::~Frame()
@@ -206,11 +203,6 @@ Frame::~Frame()
     for (HashSet<Frame*>::iterator it = openedBy.begin(); it != end; ++it)
         (*it)->setOpener(0);
     
-    if (ownerRenderer()) {
-        ownerRenderer()->setFrame(0);
-        ASSERT(!d->m_ownerElement);
-    }
-    
     if (d->m_view) {
         d->m_view->hide();
         d->m_view->m_frame = 0;
@@ -1425,8 +1417,12 @@ bool Frame::requestObject(RenderPart* renderer, const String& url, const AtomicS
     if (shouldUsePlugin(renderer->element(), completedURL, mimeType, renderer->hasFallbackContent(), useFallback))
         return loadPlugin(renderer, completedURL, mimeType, paramNames, paramValues, useFallback);
 
+    ASSERT(renderer->node()->hasTagName(objectTag) || renderer->node()->hasTagName(embedTag));
+    AtomicString uniqueFrameName = tree()->uniqueChildName(frameName);
+    static_cast<HTMLPlugInElement*>(renderer->node())->setFrameName(uniqueFrameName);
+    
     // FIXME: ok to always make a new one? when does the old frame get removed?
-    return loadSubframe(static_cast<Element*>(renderer->element()), completedURL, frameName, d->m_referrer);
+    return loadSubframe(static_cast<Element*>(renderer->node()), completedURL, uniqueFrameName, d->m_referrer);
 }
 
 bool Frame::shouldUsePlugin(Node* element, const KURL& url, const String& mimeType, bool hasFallback, bool& useFallback)
index eeeb9980b2f88517e64a69ff50363c520fdbfccf..77c27425476d05a1d2979f85a5d9e8c179e1f7c7 100644 (file)
@@ -39,8 +39,6 @@ using namespace HTMLNames;
 
 RenderPart::RenderPart(HTMLElement* node)
     : RenderWidget(node)
-    , m_frame(0)
-    , m_disconnectOwnerElementWhenDestroyed(!node->hasTagName(iframeTag))
 {
     // init RenderObject attributes
     setInline(false);
@@ -56,19 +54,6 @@ RenderPart::~RenderPart()
         static_cast<FrameView*>(widget)->deref();
     else
         delete widget;
-
-    if (m_disconnectOwnerElementWhenDestroyed)
-        setFrame(0);
-}
-
-void RenderPart::setFrame(Frame* frame)
-{
-    if (frame == m_frame)
-        return;
-
-    if (m_frame)
-        m_frame->disconnectOwnerElement();
-    m_frame = frame;
 }
 
 void RenderPart::setWidget(Widget* widget)
index f7d382aa39021179c5ea7cb9feb01920970ef640..078f2bd6811c9b6d36ec72404f6854ffb941bbf4 100644 (file)
@@ -39,7 +39,6 @@ public:
     
     virtual const char* renderName() const { return "RenderPart"; }
 
-    void setFrame(Frame*);
     void setWidget(Widget*);
 
     // FIXME: This should not be necessary.