1 files changed, 32 insertions, 43 deletions

diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index c6c4b9e9eb..8e6ffed805 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -144,10 +144,8 @@ FrameLoaderClientQt::FrameLoaderClientQt()
     , m_pluginView(0)
     , m_hasSentResponseToPlugin(false)
     , m_firstData(false)
-    , m_policyFunction(0)
     , m_loadSucceeded(false)
 {
-    connect(this, SIGNAL(sigCallPolicyFunction(int)), this, SLOT(slotCallPolicyFunction(int)), Qt::QueuedConnection);
 }
 
 
@@ -166,10 +164,14 @@ void FrameLoaderClientQt::setFrame(QWebFrame* webFrame, Frame* frame)
 
     connect(this, SIGNAL(loadStarted()),
             m_webFrame->page(), SIGNAL(loadStarted()));
+    connect(this, SIGNAL(loadStarted()),
+            m_webFrame, SIGNAL(loadStarted()));
     connect(this, SIGNAL(loadProgress(int)),
             m_webFrame->page(), SIGNAL(loadProgress(int)));
     connect(this, SIGNAL(loadFinished(bool)),
             m_webFrame->page(), SIGNAL(loadFinished(bool)));
+    connect(this, SIGNAL(loadFinished(bool)),
+            m_webFrame, SIGNAL(loadFinished(bool)));
     connect(this, SIGNAL(titleChanged(const QString&)),
             m_webFrame, SIGNAL(titleChanged(const QString&)));
 }
@@ -181,20 +183,7 @@ QWebFrame* FrameLoaderClientQt::webFrame() const
 
 void FrameLoaderClientQt::callPolicyFunction(FramePolicyFunction function, PolicyAction action)
 {
-    ASSERT(!m_policyFunction);
-    ASSERT(function);
-
-    m_policyFunction = function;
-    emit sigCallPolicyFunction(action);
-}
-
-void FrameLoaderClientQt::slotCallPolicyFunction(int action)
-{
-    if (!m_frame || !m_policyFunction)
-        return;
-    FramePolicyFunction function = m_policyFunction;
-    m_policyFunction = 0;
-    (m_frame->loader()->*function)(WebCore::PolicyAction(action));
+    (m_frame->loader()->*function)(action);
 }
 
 bool FrameLoaderClientQt::hasWebView() const
@@ -415,7 +404,6 @@ void FrameLoaderClientQt::dispatchShow()
 void FrameLoaderClientQt::cancelPolicyCheck()
 {
 //    qDebug() << "FrameLoaderClientQt::cancelPolicyCheck";
-    m_policyFunction = 0;
 }
 
 
@@ -423,7 +411,6 @@ void FrameLoaderClientQt::dispatchWillSubmitForm(FramePolicyFunction function,
                                                  PassRefPtr<FormState>)
 {
     notImplemented();
-    Q_ASSERT(!m_policyFunction);
     // FIXME: This is surely too simple
     callPolicyFunction(function, PolicyUse);
 }
@@ -692,6 +679,11 @@ void FrameLoaderClientQt::committedLoad(WebCore::DocumentLoader* loader, const c
     if (m_pluginView) {
         if (!m_hasSentResponseToPlugin) {
             m_pluginView->didReceiveResponse(loader->response());
+            // didReceiveResponse sets up a new stream to the plug-in. on a full-page plug-in, a failure in
+            // setting up this stream can cause the main document load to be cancelled, setting m_pluginView
+            // to null
+            if (!m_pluginView)
+                return;
             m_hasSentResponseToPlugin = true;
         }
         m_pluginView->didReceiveData(data, length);
@@ -887,19 +879,15 @@ WebCore::Frame* FrameLoaderClientQt::dispatchCreatePage()
 void FrameLoaderClientQt::dispatchDecidePolicyForMIMEType(FramePolicyFunction function, const WebCore::String& MIMEType, const WebCore::ResourceRequest&)
 {
     // we need to call directly here
-    Q_ASSERT(!m_policyFunction);
-    m_policyFunction = function;
     if (canShowMIMEType(MIMEType))
-        slotCallPolicyFunction(PolicyUse);
+        callPolicyFunction(function, PolicyUse);
     else
-        slotCallPolicyFunction(PolicyDownload);
+        callPolicyFunction(function, PolicyDownload);
 }
 
 void FrameLoaderClientQt::dispatchDecidePolicyForNewWindowAction(FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request, PassRefPtr<WebCore::FormState>, const WebCore::String&)
 {
-    Q_ASSERT(!m_policyFunction);
     Q_ASSERT(m_webFrame);
-    m_policyFunction = function;
 #if QT_VERSION < 0x040400
     QWebNetworkRequest r(request);
 #else
@@ -916,17 +904,15 @@ void FrameLoaderClientQt::dispatchDecidePolicyForNewWindowAction(FramePolicyFunc
             m_frame->loader()->activeDocumentLoader()->setLastCheckedRequest(emptyRequest);
         }
 
-        slotCallPolicyFunction(PolicyIgnore);
+        callPolicyFunction(function, PolicyIgnore);
         return;
     }
-    slotCallPolicyFunction(PolicyUse);
+    callPolicyFunction(function, PolicyUse);
 }
 
 void FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction(FramePolicyFunction function, const WebCore::NavigationAction& action, const WebCore::ResourceRequest& request, PassRefPtr<WebCore::FormState>)
 {
-    Q_ASSERT(!m_policyFunction);
     Q_ASSERT(m_webFrame);
-    m_policyFunction = function;
 #if QT_VERSION < 0x040400
     QWebNetworkRequest r(request);
 #else
@@ -943,10 +929,10 @@ void FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction(FramePolicyFun
             m_frame->loader()->activeDocumentLoader()->setLastCheckedRequest(emptyRequest);
         }
 
-        slotCallPolicyFunction(PolicyIgnore);
+        callPolicyFunction(function, PolicyIgnore);
         return;
     }
-    slotCallPolicyFunction(PolicyUse);
+    callPolicyFunction(function, PolicyUse);
 }
 
 void FrameLoaderClientQt::dispatchUnableToImplementPolicy(const WebCore::ResourceError&)
@@ -971,32 +957,35 @@ PassRefPtr<Frame> FrameLoaderClientQt::createFrame(const KURL& url, const String
     if (!m_webFrame)
         return 0;
 
-    QWebFrameData frameData;
+    QWebFrameData frameData(m_frame->page(), m_frame, ownerElement, name);
     frameData.url = url;
-    frameData.name = name;
-    frameData.ownerElement = ownerElement;
     frameData.referrer = referrer;
     frameData.allowsScrolling = allowsScrolling;
     frameData.marginWidth = marginWidth;
     frameData.marginHeight = marginHeight;
 
-    QWebFrame* webFrame = new QWebFrame(m_webFrame, &frameData);
-    emit m_webFrame->page()->frameCreated(webFrame);
+    QPointer<QWebFrame> webFrame = new QWebFrame(m_webFrame, &frameData);
+    // The creation of the frame may have run arbitrary JavaScript that removed it from the page already.
+    if (!webFrame->d->frame->page()) {
+        frameData.frame.release();
+        ASSERT(webFrame.isNull());
+        return 0;
+    }
 
-    RefPtr<Frame> childFrame = adoptRef(webFrame->d->frame);
+    emit m_webFrame->page()->frameCreated(webFrame);
 
     // ### set override encoding if we have one
 
     FrameLoadType loadType = m_frame->loader()->loadType();
     FrameLoadType childLoadType = FrameLoadTypeRedirectWithLockedBackForwardList;
 
-    childFrame->loader()->loadURLIntoChildFrame(frameData.url, frameData.referrer, childFrame.get());
+    frameData.frame->loader()->loadURLIntoChildFrame(frameData.url, frameData.referrer, frameData.frame.get());
 
     // The frame's onload handler may have removed it from the document.
-    if (!childFrame->tree()->parent())
+    if (!frameData.frame->tree()->parent())
         return 0;
 
-    return childFrame.release();
+    return frameData.frame.release();
 }
 
 ObjectContentType FrameLoaderClientQt::objectContentType(const KURL& url, const String& _mimeType)
@@ -1085,7 +1074,7 @@ public:
     }
 };
 
-Widget* FrameLoaderClientQt::createPlugin(const IntSize& pluginSize, HTMLPlugInElement* element, const KURL& url, const Vector<String>& paramNames,
+PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize, HTMLPlugInElement* element, const KURL& url, const Vector<String>& paramNames,
                                           const Vector<String>& paramValues, const String& mimeType, bool loadManually)
 {
 //     qDebug()<<"------ Creating plugin in FrameLoaderClientQt::createPlugin for "<<url.prettyURL() << mimeType;
@@ -1149,7 +1138,7 @@ Widget* FrameLoaderClientQt::createPlugin(const IntSize& pluginSize, HTMLPlugInE
                 QWidget* view = m_webFrame->page()->view();
                 if (view)
                     widget->setParent(view);
-                QtPluginWidget* w = new QtPluginWidget();
+                RefPtr<QtPluginWidget> w = adoptRef(new QtPluginWidget());
                 w->setPlatformWidget(widget);
                 // Make sure it's invisible until properly placed into the layout
                 w->setFrameRect(IntRect(0, 0, 0, 0));
@@ -1158,7 +1147,7 @@ Widget* FrameLoaderClientQt::createPlugin(const IntSize& pluginSize, HTMLPlugInE
             // FIXME: make things work for widgetless plugins as well
             delete object;
     } else { // NPAPI Plugins
-        PluginView* pluginView = PluginView::create(m_frame, pluginSize, element, url,
+        RefPtr<PluginView> pluginView = PluginView::create(m_frame, pluginSize, element, url,
             paramNames, paramValues, mimeType, loadManually);
         return pluginView;
     }
@@ -1173,7 +1162,7 @@ void FrameLoaderClientQt::redirectDataToPlugin(Widget* pluginWidget)
     m_hasSentResponseToPlugin = false;
 }
 
-Widget* FrameLoaderClientQt::createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL& baseURL,
+PassRefPtr<Widget> FrameLoaderClientQt::createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL& baseURL,
                                                     const Vector<String>& paramNames, const Vector<String>& paramValues)
 {
     notImplemented();