Title: [107316] branches/chromium/963
- Revision
- 107316
- Author
- [email protected]
- Date
- 2012-02-09 17:13:52 -0800 (Thu, 09 Feb 2012)
Log Message
Merge 106818
BUG=111779
Review URL: https://chromiumcodereview.appspot.com/9371034
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/fast/frames/resources/subframe-load-crash.svg (from rev 106818, trunk/LayoutTests/fast/frames/resources/subframe-load-crash.svg) (0 => 107316)
--- branches/chromium/963/LayoutTests/fast/frames/resources/subframe-load-crash.svg (rev 0)
+++ branches/chromium/963/LayoutTests/fast/frames/resources/subframe-load-crash.svg 2012-02-10 01:13:52 UTC (rev 107316)
@@ -0,0 +1,2 @@
+<g id="test"></g>
+
Copied: branches/chromium/963/LayoutTests/fast/frames/subframe-load-crash-main-expected.txt (from rev 106818, trunk/LayoutTests/fast/frames/subframe-load-crash-main-expected.txt) (0 => 107316)
--- branches/chromium/963/LayoutTests/fast/frames/subframe-load-crash-main-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/frames/subframe-load-crash-main-expected.txt 2012-02-10 01:13:52 UTC (rev 107316)
@@ -0,0 +1 @@
+PASS
Copied: branches/chromium/963/LayoutTests/fast/frames/subframe-load-crash-main.html (from rev 106818, trunk/LayoutTests/fast/frames/subframe-load-crash-main.html) (0 => 107316)
--- branches/chromium/963/LayoutTests/fast/frames/subframe-load-crash-main.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/frames/subframe-load-crash-main.html 2012-02-10 01:13:52 UTC (rev 107316)
@@ -0,0 +1,18 @@
+<html>
+<object data="" id="root" _onload_="runTest()"></object>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+function runTest() {
+ root = document.getElementById('root').contentDocument;
+ root.addEventListener('load', function() { document.open(); document.write("PASS"); document.close(); }, 1);
+ setTimeout(function() {
+ root.getElementById('test').appendChild(document.createElement('iframe'));
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }, 0);
+}
+</script>
+</html>
Modified: branches/chromium/963/Source/WebCore/loader/SubframeLoader.cpp (107315 => 107316)
--- branches/chromium/963/Source/WebCore/loader/SubframeLoader.cpp 2012-02-10 01:12:14 UTC (rev 107315)
+++ branches/chromium/963/Source/WebCore/loader/SubframeLoader.cpp 2012-02-10 01:13:52 UTC (rev 107316)
@@ -244,6 +244,8 @@
Frame* SubframeLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL& url, const String& name, const String& referrer)
{
+ RefPtr<Frame> protect(m_frame);
+
bool allowsScrolling = true;
int marginWidth = -1;
int marginHeight = -1;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
