Title: [109444] branches/chromium/1025
- Revision
- 109444
- Author
- [email protected]
- Date
- 2012-03-01 15:20:02 -0800 (Thu, 01 Mar 2012)
Log Message
Merge 109369
BUG=116224
Review URL: https://chromiumcodereview.appspot.com/9565031
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1025/LayoutTests/fast/frames/url-selected-crash-expected.txt (from rev 109369, trunk/LayoutTests/fast/frames/url-selected-crash-expected.txt) (0 => 109444)
--- branches/chromium/1025/LayoutTests/fast/frames/url-selected-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/frames/url-selected-crash-expected.txt 2012-03-01 23:20:02 UTC (rev 109444)
@@ -0,0 +1 @@
+
Copied: branches/chromium/1025/LayoutTests/fast/frames/url-selected-crash.html (from rev 109369, trunk/LayoutTests/fast/frames/url-selected-crash.html) (0 => 109444)
--- branches/chromium/1025/LayoutTests/fast/frames/url-selected-crash.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/frames/url-selected-crash.html 2012-03-01 23:20:02 UTC (rev 109444)
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<body>
+Test passes if it doesn't crash (may require libgmalloc and repeating) and this line gets erased.
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+var iterationsLeft = 2;
+function test()
+{
+ if (--iterationsLeft) {
+ frames[0].history.go(0);
+ } else {
+ document.body.textContent = frames[0].document.body.textContent;
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }
+}
+</script>
+<iframe _onload_="test()"></iframe>
+</body>
+</html>
Modified: branches/chromium/1025/Source/WebCore/loader/FrameLoader.cpp (109443 => 109444)
--- branches/chromium/1025/Source/WebCore/loader/FrameLoader.cpp 2012-03-01 23:17:52 UTC (rev 109443)
+++ branches/chromium/1025/Source/WebCore/loader/FrameLoader.cpp 2012-03-01 23:20:02 UTC (rev 109444)
@@ -250,7 +250,6 @@
void FrameLoader::changeLocation(SecurityOrigin* securityOrigin, const KURL& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool refresh)
{
- RefPtr<Frame> protect(m_frame);
urlSelected(FrameLoadRequest(securityOrigin, ResourceRequest(url, referrer, refresh ? ReloadIgnoringCacheData : UseProtocolCachePolicy), "_self"),
0, lockHistory, lockBackForwardList, MaybeSendReferrer, ReplaceDocumentIfJavaScriptURL);
}
@@ -267,6 +266,7 @@
{
ASSERT(!m_suppressOpenerInNewFrame);
+ RefPtr<Frame> protect(m_frame);
FrameLoadRequest frameRequest(passedRequest);
if (m_frame->script()->executeIfJavaScriptURL(frameRequest.resourceRequest().url(), shouldReplaceDocumentIfJavaScriptURL))
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
