Title: [96032] branches/chromium/835
- Revision
- 96032
- Author
- [email protected]
- Date
- 2011-09-26 16:26:25 -0700 (Mon, 26 Sep 2011)
Log Message
Merge 95204 - 2011-09-15 James Simonsen <[email protected]>
BUG=95761
Review URL: http://codereview.chromium.org/8037052
Modified Paths
Added Paths
Diff
Copied: branches/chromium/835/LayoutTests/plugins/destroy-during-npp-new-object-with-fallback-content-expected.txt (from rev 95204, trunk/LayoutTests/plugins/destroy-during-npp-new-object-with-fallback-content-expected.txt) (0 => 96032)
--- branches/chromium/835/LayoutTests/plugins/destroy-during-npp-new-object-with-fallback-content-expected.txt (rev 0)
+++ branches/chromium/835/LayoutTests/plugins/destroy-during-npp-new-object-with-fallback-content-expected.txt 2011-09-26 23:26:25 UTC (rev 96032)
@@ -0,0 +1 @@
+SUCCESS
Copied: branches/chromium/835/LayoutTests/plugins/destroy-during-npp-new-object-with-fallback-content.html (from rev 95204, trunk/LayoutTests/plugins/destroy-during-npp-new-object-with-fallback-content.html) (0 => 96032)
--- branches/chromium/835/LayoutTests/plugins/destroy-during-npp-new-object-with-fallback-content.html (rev 0)
+++ branches/chromium/835/LayoutTests/plugins/destroy-during-npp-new-object-with-fallback-content.html 2011-09-26 23:26:25 UTC (rev 96032)
@@ -0,0 +1,42 @@
+<html>
+<head>
+ <script type="text/_javascript_">
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.setCanOpenWindows();
+ layoutTestController.waitUntilDone();
+ }
+
+ var newWindow = window.open("data:text/html,Hello world!")
+
+ function tryCloseWindow(w) {
+ if (!w)
+ return;
+
+ w.close();
+
+ function doneIfClosed() {
+ if (w.closed) {
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ return;
+ }
+ setTimeout(doneIfClosed, 1);
+ };
+ doneIfClosed();
+ }
+
+ window._onload_ = function() {
+ tryCloseWindow(newWindow);
+
+ var testPlugin = document.getElementById('testPlugin');
+ if (!testPlugin || !testPlugin.parentNode)
+ document.documentElement.appendChild(document.createTextNode("SUCCESS"));
+ }
+ </script>
+</head>
+<body>
+ <p>This tests a plug-in that removes itself from the document during NPP_New. It passes if it does not crash during removal (<a href="" or when a window is next closed (<a href=""
+ <object id="testPlugin" type="application/x-webkit-test-netscape" width="200" height="200" cleardocumentduringnew>fallback content</object>
+</body>
+</html>
Modified: branches/chromium/835/Source/WebCore/html/HTMLEmbedElement.cpp (96031 => 96032)
--- branches/chromium/835/Source/WebCore/html/HTMLEmbedElement.cpp 2011-09-26 23:23:27 UTC (rev 96031)
+++ branches/chromium/835/Source/WebCore/html/HTMLEmbedElement.cpp 2011-09-26 23:26:25 UTC (rev 96032)
@@ -178,6 +178,7 @@
return;
}
+ RefPtr<HTMLEmbedElement> protect(this); // Loading the plugin might remove us from the document.
SubframeLoader* loader = document()->frame()->loader()->subframeLoader();
// FIXME: beforeLoad could have detached the renderer! Just like in the <object> case above.
loader->requestObject(this, m_url, getAttribute(nameAttr), m_serviceType, paramNames, paramValues);
Modified: branches/chromium/835/Source/WebCore/html/HTMLObjectElement.cpp (96031 => 96032)
--- branches/chromium/835/Source/WebCore/html/HTMLObjectElement.cpp 2011-09-26 23:23:27 UTC (rev 96031)
+++ branches/chromium/835/Source/WebCore/html/HTMLObjectElement.cpp 2011-09-26 23:26:25 UTC (rev 96032)
@@ -329,6 +329,7 @@
if (!renderer())
return;
+ RefPtr<HTMLObjectElement> protect(this); // Loading the plugin might remove us from the document.
SubframeLoader* loader = document()->frame()->loader()->subframeLoader();
bool success = beforeLoadAllowedLoad && hasValidClassId() && loader->requestObject(this, url, getAttribute(nameAttr), serviceType, paramNames, paramValues);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
