Diff
Modified: trunk/LayoutTests/ChangeLog (109479 => 109480)
--- trunk/LayoutTests/ChangeLog 2012-03-02 02:23:36 UTC (rev 109479)
+++ trunk/LayoutTests/ChangeLog 2012-03-02 02:29:59 UTC (rev 109480)
@@ -1,3 +1,15 @@
+2012-03-01 Kent Tamura <[email protected]>
+
+ REGRESSION(r106388): Form state is restored to a wrong document.
+ https://bugs.webkit.org/show_bug.cgi?id=79206
+
+ Reviewed by Brady Eidson.
+
+ * fast/loader/form-state-restore-with-locked-back-forward-list-expected.txt: Added.
+ * fast/loader/form-state-restore-with-locked-back-forward-list.html: Added.
+ * fast/loader/resources/form-state-restore-with-locked-back-forward-list-2.html: Added.
+ * fast/loader/resources/form-state-restore-with-locked-back-forward-list-3.html: Added.
+
2012-03-01 Adam Klein <[email protected]>
Unreviewed gardening. Mark a JS strict mode test as failing in V8,
Added: trunk/LayoutTests/fast/loader/form-state-restore-with-locked-back-forward-list-expected.txt (0 => 109480)
--- trunk/LayoutTests/fast/loader/form-state-restore-with-locked-back-forward-list-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/loader/form-state-restore-with-locked-back-forward-list-expected.txt 2012-03-02 02:29:59 UTC (rev 109480)
@@ -0,0 +1,2 @@
+PASS location.search is "?TestName1=Ok1&TestName2=Ok2"
+
Added: trunk/LayoutTests/fast/loader/form-state-restore-with-locked-back-forward-list.html (0 => 109480)
--- trunk/LayoutTests/fast/loader/form-state-restore-with-locked-back-forward-list.html (rev 0)
+++ trunk/LayoutTests/fast/loader/form-state-restore-with-locked-back-forward-list.html 2012-03-02 02:29:59 UTC (rev 109480)
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<body _onLoad_="document.forms[0].submit();">
+<form method=POST action=""
+<input name="TestName1" type="hidden" value="Bad1">
+<input name="TestName2" type="hidden" value="Bad2">
+</form>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+</script>
+</body>
+</html>
Added: trunk/LayoutTests/fast/loader/resources/form-state-restore-with-locked-back-forward-list-2.html (0 => 109480)
--- trunk/LayoutTests/fast/loader/resources/form-state-restore-with-locked-back-forward-list-2.html (rev 0)
+++ trunk/LayoutTests/fast/loader/resources/form-state-restore-with-locked-back-forward-list-2.html 2012-03-02 02:29:59 UTC (rev 109480)
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body _onLoad_="document.forms[0].submit();">
+<form method="GET" action=""
+<input name="TestName1" type="hidden" value="Ok1">
+<input name="TestName2" type="hidden" value="Ok2">
+</form>
+</body>
+</html>
Added: trunk/LayoutTests/fast/loader/resources/form-state-restore-with-locked-back-forward-list-3.html (0 => 109480)
--- trunk/LayoutTests/fast/loader/resources/form-state-restore-with-locked-back-forward-list-3.html (rev 0)
+++ trunk/LayoutTests/fast/loader/resources/form-state-restore-with-locked-back-forward-list-3.html 2012-03-02 02:29:59 UTC (rev 109480)
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<body>
+<script src=""
+<script>
+shouldBeEqualToString("location.search", '?TestName1=Ok1&TestName2=Ok2');
+if (window.layoutTestController)
+ layoutTestController.notifyDone();
+</script>
+</body>
Modified: trunk/Source/WebCore/ChangeLog (109479 => 109480)
--- trunk/Source/WebCore/ChangeLog 2012-03-02 02:23:36 UTC (rev 109479)
+++ trunk/Source/WebCore/ChangeLog 2012-03-02 02:29:59 UTC (rev 109480)
@@ -1,3 +1,30 @@
+2012-03-01 Kent Tamura <[email protected]>
+
+ REGRESSION(r106388): Form state is restored to a wrong document.
+ https://bugs.webkit.org/show_bug.cgi?id=79206
+
+ Reviewed by Brady Eidson.
+
+ In some cases, the URL of the current HistoryItem and the document
+ URL are mismatched.
+ A form state should be restored only if the document was loaded
+ with a HistoryItem and the document is not loaded as a
+ redirection.
+
+ Test: fast/loader/form-state-restore-with-locked-back-forward-list.html
+
+ * loader/FrameLoader.cpp:
+ (WebCore::FrameLoader::checkCompleted): Clear m_requestedHistoryItem.
+ (WebCore::FrameLoader::loadItem):
+ Save the requested HistoryItem for didLoadWithLodItem().
+ * loader/FrameLoader.h:
+ (WebCore::FrameLoader::requestedHistoryItem):
+ Added. Accessor for m_requestedHistoryItem.
+ * loader/HistoryController.cpp:
+ (WebCore::HistoryController::restoreDocumentState):
+ Restore a form state only if the current document was loaded with
+ FrameLoader::loadItem() and not redirection.
+
2012-03-01 Xingnan Wang <[email protected]>
SSE optimization for vsvesq and vmaxmgv
Modified: trunk/Source/WebCore/loader/FrameLoader.cpp (109479 => 109480)
--- trunk/Source/WebCore/loader/FrameLoader.cpp 2012-03-02 02:23:36 UTC (rev 109479)
+++ trunk/Source/WebCore/loader/FrameLoader.cpp 2012-03-02 02:29:59 UTC (rev 109480)
@@ -738,6 +738,7 @@
// OK, completed.
m_isComplete = true;
+ m_requestedHistoryItem = 0;
m_frame->document()->setReadyState(Document::Complete);
RefPtr<Frame> protect(m_frame);
@@ -3173,6 +3174,7 @@
// Loads content into this frame, as specified by history item
void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
{
+ m_requestedHistoryItem = item;
HistoryItem* currentItem = history()->currentItem();
bool sameDocumentNavigation = currentItem && item->shouldDoSameDocumentNavigationTo(currentItem);
Modified: trunk/Source/WebCore/loader/FrameLoader.h (109479 => 109480)
--- trunk/Source/WebCore/loader/FrameLoader.h 2012-03-02 02:23:36 UTC (rev 109479)
+++ trunk/Source/WebCore/loader/FrameLoader.h 2012-03-02 02:29:59 UTC (rev 109480)
@@ -119,6 +119,7 @@
void open(CachedFrameBase&);
void loadItem(HistoryItem*, FrameLoadType);
+ HistoryItem* requestedHistoryItem() const { return m_requestedHistoryItem.get(); }
static void reportLocalLoadFailed(Frame*, const String& url);
@@ -437,6 +438,7 @@
#endif
KURL m_previousUrl;
+ RefPtr<HistoryItem> m_requestedHistoryItem;
};
// This function is called by createWindow() in JSDOMWindowBase.cpp, for example, for
Modified: trunk/Source/WebCore/loader/HistoryController.cpp (109479 => 109480)
--- trunk/Source/WebCore/loader/HistoryController.cpp 2012-03-02 02:23:36 UTC (rev 109479)
+++ trunk/Source/WebCore/loader/HistoryController.cpp 2012-03-02 02:29:59 UTC (rev 109480)
@@ -200,9 +200,10 @@
if (!itemToRestore)
return;
-
- LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->uniqueName().string().utf8().data(), itemToRestore);
- doc->setStateForNewFormElements(itemToRestore->documentState());
+ if (m_frame->loader()->requestedHistoryItem() == m_currentItem.get() && !m_frame->loader()->documentLoader()->isClientRedirect()) {
+ LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->uniqueName().string().utf8().data(), itemToRestore);
+ doc->setStateForNewFormElements(itemToRestore->documentState());
+ }
}
void HistoryController::invalidateCurrentItemCachedPage()
