1 files changed, 57 insertions, 8 deletions

diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
index 80df829..76f3ed4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
@@ -50,8 +50,10 @@ HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Documen
     , m_scrolling(ScrollbarAuto)
     , m_marginWidth(-1)
     , m_marginHeight(-1)
+    , m_checkAttachedTimer(this, &HTMLFrameElementBase::checkAttachedTimerFired)
     , m_viewSource(false)
     , m_shouldOpenURLAfterAttach(false)
+    , m_remainsAliveOnRemovalFromTree(false)
 {
 }
 
@@ -88,7 +90,7 @@ bool HTMLFrameElementBase::isURLAllowed() const
     return true;
 }
 
-void HTMLFrameElementBase::openURL()
+void HTMLFrameElementBase::openURL(bool lockHistory, bool lockBackForwardList)
 {
     ASSERT(!m_frameName.isEmpty());
 
@@ -102,7 +104,7 @@ void HTMLFrameElementBase::openURL()
     if (!parentFrame)
         return;
 
-    parentFrame->loader()->requestFrame(this, m_URL, m_frameName);
+    parentFrame->loader()->requestFrame(this, m_URL, m_frameName, lockHistory, lockBackForwardList);
     if (contentFrame())
         contentFrame()->setInViewSourceMode(viewSourceMode());
 }
@@ -111,7 +113,7 @@ void HTMLFrameElementBase::parseMappedAttribute(MappedAttribute *attr)
 {
     if (attr->name() == srcAttr)
         setLocation(deprecatedParseURL(attr->value()));
-    else if (attr->name() == idAttr) {
+    else if (attr->name() == idAttributeName()) {
         // Important to call through to base for the id attribute so the hasID bit gets set.
         HTMLFrameOwnerElement::parseMappedAttribute(attr);
         m_frameName = attr->value();
@@ -148,15 +150,19 @@ void HTMLFrameElementBase::parseMappedAttribute(MappedAttribute *attr)
         HTMLFrameOwnerElement::parseMappedAttribute(attr);
 }
 
-void HTMLFrameElementBase::setNameAndOpenURL()
+void HTMLFrameElementBase::setName()
 {
     m_frameName = getAttribute(nameAttr);
     if (m_frameName.isNull())
-        m_frameName = getAttribute(idAttr);
+        m_frameName = getAttribute(idAttributeName());
     
     if (Frame* parentFrame = document()->frame())
         m_frameName = parentFrame->tree()->uniqueChildName(m_frameName);
-    
+}
+
+void HTMLFrameElementBase::setNameAndOpenURL()
+{
+    setName();
     openURL();
 }
 
@@ -165,6 +171,14 @@ void HTMLFrameElementBase::setNameAndOpenURLCallback(Node* n)
     static_cast<HTMLFrameElementBase*>(n)->setNameAndOpenURL();
 }
 
+void HTMLFrameElementBase::updateOnReparenting()
+{
+    ASSERT(m_remainsAliveOnRemovalFromTree);
+
+    if (Frame* frame = contentFrame())
+        frame->transferChildFrameToNewDocument();
+}
+
 void HTMLFrameElementBase::insertedIntoDocument()
 {
     HTMLFrameOwnerElement::insertedIntoDocument();
@@ -173,6 +187,9 @@ void HTMLFrameElementBase::insertedIntoDocument()
     // Othewise, a synchronous load that executed JavaScript would see incorrect 
     // (0) values for the frame's renderer-dependent properties, like width.
     m_shouldOpenURLAfterAttach = true;
+
+    if (m_remainsAliveOnRemovalFromTree)
+        updateOnReparenting();
 }
 
 void HTMLFrameElementBase::removedFromDocument()
@@ -186,9 +203,12 @@ void HTMLFrameElementBase::attach()
 {
     if (m_shouldOpenURLAfterAttach) {
         m_shouldOpenURLAfterAttach = false;
-        queuePostAttachCallback(&HTMLFrameElementBase::setNameAndOpenURLCallback, this);
+        if (!m_remainsAliveOnRemovalFromTree)
+            queuePostAttachCallback(&HTMLFrameElementBase::setNameAndOpenURLCallback, this);
     }
 
+    setRemainsAliveOnRemovalFromTree(false);
+
     HTMLFrameOwnerElement::attach();
     
     if (RenderPart* renderPart = toRenderPart(renderer())) {
@@ -211,7 +231,7 @@ void HTMLFrameElementBase::setLocation(const String& str)
     m_URL = AtomicString(str);
 
     if (inDocument())
-        openURL();
+        openURL(false, false);
 }
 
 bool HTMLFrameElementBase::supportsFocus() const
@@ -249,4 +269,33 @@ int HTMLFrameElementBase::height() const
     return toRenderBox(renderer())->height();
 }
 
+void HTMLFrameElementBase::setRemainsAliveOnRemovalFromTree(bool value)
+{
+    m_remainsAliveOnRemovalFromTree = value;
+
+    // There is a possibility that JS will do document.adoptNode() on this element but will not insert it into the tree.
+    // Start the async timer that is normally stopped by attach(). If it's not stopped and fires, it'll unload the frame.
+    if (value)
+        m_checkAttachedTimer.startOneShot(0);
+    else
+        m_checkAttachedTimer.stop();
+}
+
+void HTMLFrameElementBase::checkAttachedTimerFired(Timer<HTMLFrameElementBase>*)
+{
+    ASSERT(!attached());
+    ASSERT(m_remainsAliveOnRemovalFromTree);
+
+    m_remainsAliveOnRemovalFromTree = false;
+    willRemove();
+}
+
+void HTMLFrameElementBase::willRemove()
+{
+    if (m_remainsAliveOnRemovalFromTree)
+        return;
+
+    HTMLFrameOwnerElement::willRemove();
+}
+
 } // namespace WebCore