Title: [165139] branches/safari-537.75-branch
Diff
Modified: branches/safari-537.75-branch/LayoutTests/ChangeLog (165138 => 165139)
--- branches/safari-537.75-branch/LayoutTests/ChangeLog 2014-03-06 00:05:55 UTC (rev 165138)
+++ branches/safari-537.75-branch/LayoutTests/ChangeLog 2014-03-06 00:11:39 UTC (rev 165139)
@@ -1,5 +1,21 @@
2014-03-05 Matthew Hanson <[email protected]>
+ Merge r164204.
+
+ 2014-02-16 Andreas Kling <[email protected]>
+
+ Ensure that removing an iframe from the DOM tree disconnects its Frame.
+ <https://webkit.org/b/128889>
+ <rdar://problem/15671221>
+
+ Merged from Blink (patch by Adam Klein):
+ https://src.chromium.org/viewvc/blink?revision=156174&view=revision
+
+ * fast/frames/reattach-in-unload-expected.txt: Added.
+ * fast/frames/reattach-in-unload.html: Added.
+
+2014-03-05 Matthew Hanson <[email protected]>
+
Merge r158697.
2013-11-05 Enrica Casucci <[email protected]>
Copied: branches/safari-537.75-branch/LayoutTests/fast/frames/reattach-in-unload-expected.txt (from rev 164204, trunk/LayoutTests/fast/frames/reattach-in-unload-expected.txt) (0 => 165139)
--- branches/safari-537.75-branch/LayoutTests/fast/frames/reattach-in-unload-expected.txt (rev 0)
+++ branches/safari-537.75-branch/LayoutTests/fast/frames/reattach-in-unload-expected.txt 2014-03-06 00:11:39 UTC (rev 165139)
@@ -0,0 +1,12 @@
+Ensure that removing an iframe from the tree results in frame destruction
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS frame.contentWindow is null
+PASS frame.contentWindow is null
+Did not crash
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/safari-537.75-branch/LayoutTests/fast/frames/reattach-in-unload.html (from rev 164204, trunk/LayoutTests/fast/frames/reattach-in-unload.html) (0 => 165139)
--- branches/safari-537.75-branch/LayoutTests/fast/frames/reattach-in-unload.html (rev 0)
+++ branches/safari-537.75-branch/LayoutTests/fast/frames/reattach-in-unload.html 2014-03-06 00:11:39 UTC (rev 165139)
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<body>
+<script src=""
+<script>
+description('Ensure that removing an iframe from the tree results in frame destruction');
+
+var frame = document.createElement('iframe');
+function handler() {
+ var p = frame.parentNode;
+ p.removeChild(frame);
+ p.appendChild(frame);
+}
+
+document.body.appendChild(frame);
+frame.contentWindow._onunload_ = handler;
+frame.parentNode.removeChild(frame)
+shouldBeNull("frame.contentWindow");
+
+var div = document.body.appendChild(document.createElement('div'));
+div.appendChild(frame);
+div.removeChild(frame);
+shouldBeNull("frame.contentWindow");
+debug('Did not crash');
+</script>
+</body>
Modified: branches/safari-537.75-branch/Source/WebCore/ChangeLog (165138 => 165139)
--- branches/safari-537.75-branch/Source/WebCore/ChangeLog 2014-03-06 00:05:55 UTC (rev 165138)
+++ branches/safari-537.75-branch/Source/WebCore/ChangeLog 2014-03-06 00:11:39 UTC (rev 165139)
@@ -1,5 +1,28 @@
2014-03-05 Matthew Hanson <[email protected]>
+ Merge r164204.
+
+ 2014-02-16 Andreas Kling <[email protected]>
+
+ Ensure that removing an iframe from the DOM tree disconnects its Frame.
+ <https://webkit.org/b/128889>
+ <rdar://problem/15671221>
+
+ Merged from Blink (patch by Adam Klein):
+ https://src.chromium.org/viewvc/blink?revision=156174&view=revision
+
+ SubframeLoadingDisabler wasn't catching the case when an <iframe> was,
+ in its unload handler, removed and re-added to the same parent.
+ Fix this by using a count of SubframeLoadingDisablers that are on the
+ stack for a given root, rather than a simple boolean.
+
+ Test: fast/frames/reattach-in-unload.html
+
+ * html/HTMLFrameOwnerElement.h:
+ (WebCore::SubframeLoadingDisabler::disabledSubtreeRoots):
+
+2014-03-05 Matthew Hanson <[email protected]>
+
Merge r157957.
2013-10-24 Daniel Bates <[email protected]>
Modified: branches/safari-537.75-branch/Source/WebCore/html/HTMLFrameOwnerElement.h (165138 => 165139)
--- branches/safari-537.75-branch/Source/WebCore/html/HTMLFrameOwnerElement.h 2014-03-06 00:05:55 UTC (rev 165138)
+++ branches/safari-537.75-branch/Source/WebCore/html/HTMLFrameOwnerElement.h 2014-03-06 00:11:39 UTC (rev 165139)
@@ -23,6 +23,7 @@
#include "FrameLoaderTypes.h"
#include "HTMLElement.h"
+#include <wtf/HashCountedSet.h>
namespace WebCore {
@@ -101,9 +102,9 @@
}
private:
- static HashSet<Node*>& disabledSubtreeRoots()
+ static HashCountedSet<Node*>& disabledSubtreeRoots()
{
- DEFINE_STATIC_LOCAL(HashSet<Node*>, nodes, ());
+ DEFINE_STATIC_LOCAL(HashCountedSet<Node*>, nodes, ());
return nodes;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
