REGRESSION: ASSERT in Frame::paint making flash video full screen

• Component: WebCore Misc.
• Status: NEW ---

[Matt Lilek]

1. Load <http://www.dailybuzzer.com/nasa-makes-magnetic-fields-visible-video>
2. Begin playing the video under the title "Watch the Magnetic Movie"
3. Click the full screen icon between the volume control and the "Vimeo" branding
4. BOOM.  In a debug build:

ASSERTION FAILED: !d->m_isPainting
<http://trac.webkit.org/browser/trunk/WebCore/page/Frame.cpp#L1361>

Thread 0 Crashed:
0   com.apple.WebCore             	0x02876985 WebCore::Frame::paint(WebCore::GraphicsContext*, WebCore::IntRect const&) + 599 (Frame.cpp:1361)
1   com.apple.WebCore             	0x028a0ff8 WebCore::FrameView::updateControlTints() + 368 (FrameView.cpp:1124)
2   com.apple.WebKit              	0x001e7838 -[WebHTMLView _windowChangedKeyState] + 84 (WebHTMLView.mm:4542)
3   com.apple.CoreFoundation      	0x94442cb6 CFArrayApplyFunction + 198
4   com.apple.AppKit              	0x9034297f -[NSView _windowChangedKeyState] + 127

This is a regression from Safari 3.1.  Using Flash 9.0 r124 fwiw.

paint() is re-entered because the plug-in reorders windows (thus changing the Safari window's key state) during its drawRect callback, which is invoked under the outer paint().

[Maxime Britto]

Also visible at http://ll.static.abc.go.com/streaming/move/00080005/static.html?aff=kgo&affTo=kgo&useexternal=0&channelid=77803&episodeid=85332&partner=&campaign=&wrapped=1&affFrom=abc&affLost=kgo&dmarank=6&dmazip=94002
 when trying to go fullscreen.

By disabling the Assert and using the early return present after the Assert no crash happened and the video was played correctly.

<rdar://problem/6509966>