Bug 49489

Summary:

Replace null checks of newParent in Frame::transferChildFrameToNewDocument() with ASSERT

Product:

WebKit

Reporter:

Daniel Bates <dbates>

Component:

WebCore Misc.

Assignee:

Daniel Bates <dbates>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

abarth, ap, dimich, fishd, hausmann, jennb, levin

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Bug Depends on:

48768

Bug Blocks:

Attachments:

Description	Flags
Patch	none

Daniel Bates

Reported 2010-11-12 21:42:13 PST

It is not possible for newParent to be null in Frame::transferChildFrameToNewDocument() based on the the call order of HTMLFrameElementBase::setRemainsAliveOnRemovalFromTree() and Frame::transferChildFrameToNewDocument(): Frame::transferChildFrameToNewDocument() is only called if HTMLFrameElementBase::m_remainsAliveOnRemovalFromTree is true by line 177 <http://trac.webkit.org/browser/trunk/WebCore/html/HTMLFrameElementBase.cpp?rev=71219#L177> and line 169 <http://trac.webkit.org/browser/trunk/WebCore/html/HTMLFrameElementBase.cpp?rev=71219#L169> of r71219 of HTMLFrameElementBase.cpp. Without loss of generality, HTMLFrameElementBase::m_remainsAliveOnRemovalFromTree is set to true if the document that is adopting the <iframe> is attached() by line 880 of r71767 of Document.cpp <http://trac.webkit.org/browser/trunk/WebCore/dom/Document.cpp?rev=71767#L880> and line 264 of r71219 of HTMLFrameElementBase.cpp <http://trac.webkit.org/browser/trunk/WebCore/html/HTMLFrameElementBase.cpp?rev=71219#L264>. Moreover, Document::adoptNode() (line 880 of r71767 of Document.cpp) is the only caller of HTMLFrameElementBase::setRemainsAliveOnRemovalFromTree(). Notice, a Document D is said to be attached if Frame::setDocument() is called on it AND by the ASSERT in Frame::setDocument() <http://trac.webkit.org/browser/trunk/WebCore/page/Frame.cpp?rev=71493#L279> D must have a non-null pointer to a Frame object. So, Frame::transferChildFrameToNewDocument() is only called if the document the <iframe> is being transferred to has a frame (i.e. m_ownerElement->document()->frame() != NULL); => newParent cannot be NULL.

Attachments
Patch (1.97 KB, patch) 2010-11-16 13:57 PST, Daniel Bates	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Daniel Bates

Comment 1 2010-11-16 13:57:25 PST

Created attachment 74040 [details] Patch

Daniel Bates

Comment 2 2010-11-19 12:08:40 PST

Comment on attachment 74040 [details] Patch Clearing flags on attachment: 74040 Committed r72423: <http://trac.webkit.org/changeset/72423>

Daniel Bates

Comment 3 2010-11-19 12:08:48 PST

All reviewed patches have been landed. Closing bug.

Note You need to log in before you can comment on or make changes to this bug.