• japhet@chromium.org's avatar
    Source/WebCore: Unload events can crash us when they blank out · 8809405d
    japhet@chromium.org authored
    a parent frame.
    https://bugs.webkit.org/show_bug.cgi?id=64741
    
    Reviewed by Adam Barth.
    
    Test: fast/loader/document-destruction-within-unload.html
    
    * loader/FrameLoader.cpp:
    (WebCore::FrameLoader::stopLoading): Prevent unload events
        from going into infinite recursion.
    (WebCore::FrameLoader::setDocumentLoader): Ensure we don't
        let set m_documentLoader to a DocumentLoader with a null Frame*.
    (WebCore::FrameLoader::detachChildren): Save off a vector of
        children to detach, rather than doing it inline.
    
    LayoutTests: Test for https://bugs.webkit.org/show_bug.cgi?id=64741.
    
    Reviewed by Adam Barth.
    
    * fast/loader/document-destruction-within-unload-expected.txt: Added.
    * fast/loader/document-destruction-within-unload.html: Added.
    * fast/loader/resources/document-destruction-within-unload-iframe.html: Added.
    * fast/loader/resources/document-destruction-within-unload.svg: Added.
    
    
    git-svn-id: svn://svn.chromium.org/blink/trunk@93521 bbb929c8-8fbe-4397-9dbb-9b2b20218538
    8809405d
document-destruction-within-unload.html 420 Bytes