2007-01-18 Mitz Pettel <mitz@webkit.org>

        Reviewed by Darin.

        - fix http://bugs.webkit.org/show_bug.cgi?id=9952
          REGRESSION: Repro crash when dragging an image from the window to the address bar

        * page/FrameView.cpp:
        (WebCore::FrameView::~FrameView): Removed the call to Document::detach(). If this
        view is the current view, then the Frame should have already detached the document.
        Added an assertion that this is the case. If this view is not the current view,
        then it cannot access its document, but the page cache should have detached it already.
        Similarly, changed to call RenderPart::setWidget() only if this is the current view
        in the frame.
        (WebCore::FrameView::adjustViewSize): Added an assertion that this view is the current
        view in the frame.
        (WebCore::FrameView::layout): Ditto.
        (WebCore::FrameView::scheduleRelayout): Ditto.
        (WebCore::FrameView::scheduleRelayoutOfSubtree): Ditto.
        (WebCore::FrameView::windowClipRect): Ditto.


git-svn-id: svn://svn.chromium.org/blink/trunk@18965 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/WebCore/ChangeLog

+2007-01-18  Mitz Pettel  <mitz@webkit.org>
+
+        Reviewed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=9952
+          REGRESSION: Repro crash when dragging an image from the window to the address bar
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::~FrameView): Removed the call to Document::detach(). If this
+        view is the current view, then the Frame should have already detached the document.
+        Added an assertion that this is the case. If this view is not the current view,
+        then it cannot access its document, but the page cache should have detached it already.
+        Similarly, changed to call RenderPart::setWidget() only if this is the current view
+        in the frame.
+        (WebCore::FrameView::adjustViewSize): Added an assertion that this view is the current
+        view in the frame.
+        (WebCore::FrameView::layout): Ditto.
+        (WebCore::FrameView::scheduleRelayout): Ditto.
+        (WebCore::FrameView::scheduleRelayoutOfSubtree): Ditto.
+        (WebCore::FrameView::windowClipRect): Ditto.
+
 2007-01-18  Eric Seidel  <eric@webkit.org>
 
         Reviewed by bdash.

third_party/WebKit/WebCore/page/FrameView.cpp

@@ -132,10 +132,9 @@ FrameView::~FrameView()
     ASSERT(m_refCount == 0);
 
     if (m_frame) {
-        // FIXME: Is this really the right place to call detach on the document?
-        if (Document* doc = m_frame->document())
-            doc->detach();
-        if (RenderPart* renderer = m_frame->ownerRenderer())
+        ASSERT(m_frame->view() != this || !m_frame->document() || !m_frame->document()->renderer());
+        RenderPart* renderer = m_frame->ownerRenderer();
+        if (renderer && renderer->widget() == this)
             renderer->setWidget(0);
     }
 
@@ -215,9 +214,8 @@ void FrameView::setMarginHeight(int h)
 
 void FrameView::adjustViewSize()
 {
-    if (m_frame->document()) {
-        Document* document = m_frame->document();
-
+    ASSERT(m_frame->view() == this);
+    if (Document* document = m_frame->document()) {
         RenderView* root = static_cast<RenderView*>(document->renderer());
         if (!root)
             return;
@@ -310,6 +308,9 @@ void FrameView::layout(bool allowSubtree)
     }
 
     bool subtree = d->layoutRoot;
+
+    ASSERT(m_frame->view() == this);
+
     Document* document = m_frame->document();
     if (!document) {
         // FIXME: Should we set m_size.height here too?
@@ -634,6 +635,8 @@ void FrameView::layoutTimerFired(Timer<FrameView>*)
 
 void FrameView::scheduleRelayout()
 {
+    ASSERT(m_frame->view() == this);
+
     if (d->layoutRoot) {
         if (d->layoutRoot->renderer())
             d->layoutRoot->renderer()->markContainingBlocksForLayout(false);
@@ -663,6 +666,8 @@ void FrameView::scheduleRelayout()
 
 void FrameView::scheduleRelayoutOfSubtree(Node* n)
 {
+    ASSERT(m_frame->view() == this);
+
     if (!d->layoutSchedulingEnabled || (m_frame->document()
             && m_frame->document()->renderer()
             && m_frame->document()->renderer()->needsLayout())) {
@@ -810,6 +815,8 @@ IntRect FrameView::windowClipRect() const
 
 IntRect FrameView::windowClipRect(bool clipToContents) const
 {
+    ASSERT(m_frame->view() == this);
+
     // Set our clip rect to be our contents.
     IntRect clipRect;
     if (clipToContents)