Merge 77705 - 2011-02-04 Charlie Reis <creis@chromium.org>...

Source/WebCore/loader/HistoryController.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
@@ skipping 218 matching lines @@
     // <rdar://problem/3979539> back/forward cache navigations should consult policy delegate
     Page* page = m_frame->page();
     if (!page)
         return;
     if (!m_frame->loader()->client()->shouldGoToHistoryItem(targetItem))
         return;
 
     // Set the BF cursor before commit, which lets the user quickly click back/forward again.
     // - plus, it only makes sense for the top level of the operation through the frametree,
     // as opposed to happening for some/one of the page commits that might happen soon
-    HistoryItem* currentItem = page->backForward()->currentItem();    
+    RefPtr<HistoryItem> currentItem = page->backForward()->currentItem();
     page->backForward()->setCurrentItem(targetItem);
     Settings* settings = m_frame->settings();
     page->setGlobalHistoryItem((!settings || settings->privateBrowsingEnabled()) ? 0 : targetItem);
 
     // First set the provisional item of any frames that are not actually navigating.
     // This must be done before trying to navigate the desired frame, because some
     // navigations can commit immediately (such as about:blank).  We must be sure that
     // all frames have provisional items set before the commit.
-    recursiveSetProvisionalItem(targetItem, currentItem, type);
+    recursiveSetProvisionalItem(targetItem, currentItem.get(), type);
     // Now that all other frames have provisional items, do the actual navigation.
-    recursiveGoToItem(targetItem, currentItem, type);
+    recursiveGoToItem(targetItem, currentItem.get(), type);
 }
 
 void HistoryController::updateForBackForwardNavigation()
 {
 #if !LOG_DISABLED
     if (m_frame->loader()->documentLoader())
         LOG(History, "WebCoreHistory: Updating History for back/forward navigation in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
 #endif
 
     // Must grab the current scroll position before disturbing it
@@ skipping 134 matching lines @@
 }
 
 void HistoryController::updateForCommit()
 {
     FrameLoader* frameLoader = m_frame->loader();
 #if !LOG_DISABLED
     if (frameLoader->documentLoader())
         LOG(History, "WebCoreHistory: Updating History for commit in frame %s", frameLoader->documentLoader()->title().utf8().data());
 #endif
     FrameLoadType type = frameLoader->loadType();
-    if (isBackForwardLoadType(type) ||
-        ((type == FrameLoadTypeReload || type == FrameLoadTypeReloadFromOrigin) && !frameLoader->provisionalDocumentLoader()->unreachableURL().isEmpty())) {
+    if (isBackForwardLoadType(type)
+        || isReplaceLoadTypeWithProvisionalItem(type)
+        || ((type == FrameLoadTypeReload || type == FrameLoadTypeReloadFromOrigin) && !frameLoader->provisionalDocumentLoader()->unreachableURL().isEmpty())) {
         // Once committed, we want to use current item for saving DocState, and
         // the provisional item for restoring state.
         // Note previousItem must be set before we close the URL, which will
         // happen when the data source is made non-provisional below
         m_frameLoadComplete = false;
         m_previousItem = m_currentItem;
         ASSERT(m_provisionalItem);
         m_currentItem = m_provisionalItem;
         m_provisionalItem = 0;
 
         // Tell all other frames in the tree to commit their provisional items and
         // restore their scroll position.  We'll avoid this frame (which has already
         // committed) and its children (which will be replaced).
         Page* page = m_frame->page();
         ASSERT(page);
         page->mainFrame()->loader()->history()->recursiveUpdateForCommit();
     }
 }
 
+bool HistoryController::isReplaceLoadTypeWithProvisionalItem(FrameLoadType type)
+{
+    // Going back to an error page in a subframe can trigger a FrameLoadTypeReplace
+    // while m_provisionalItem is set, so we need to commit it.
+    return type == FrameLoadTypeReplace && m_provisionalItem;
+}
+
 void HistoryController::recursiveUpdateForCommit()
 {
     // The frame that navigated will now have a null provisional item.
     // Ignore it and its children.
     if (!m_provisionalItem)
         return;
 
     // For each frame that already had the content the item requested (based on
     // (a matching URL and frame tree snapshot), just restore the scroll position.
     // Save form state (works from currentItem, since m_frameLoadComplete is true)
@@ skipping 28 matching lines @@
 
     Settings* settings = m_frame->settings();
     if (!settings || settings->privateBrowsingEnabled())
         return;
 
     Page* page = m_frame->page();
     if (!page)
         return;
 
     addVisitedLink(page, m_frame->loader()->url());
+    page->mainFrame()->loader()->history()->recursiveUpdateForSameDocumentNavigation();
+}
+
+void HistoryController::recursiveUpdateForSameDocumentNavigation()
+{
+    // The frame that navigated will now have a null provisional item.
+    // Ignore it and its children.
+    if (!m_provisionalItem)
+        return;
+
+    // Commit the provisional item.
+    m_frameLoadComplete = false;
+    m_previousItem = m_currentItem;
+    m_currentItem = m_provisionalItem;
+    m_provisionalItem = 0;
+
+    // Iterate over the rest of the tree.
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
+        child->loader()->history()->recursiveUpdateForSameDocumentNavigation();
 }
 
 void HistoryController::updateForFrameLoadCompleted()
 {
     // Even if already complete, we might have set a previous item on a frame that
     // didn't do any data loading on the past transaction. Make sure to track that
     // the load is complete so that we use the current item instead.
     m_frameLoadComplete = true;
 }
 
@@ skipping 129 matching lines @@
     ASSERT(item);
     ASSERT(fromItem);
 
     if (itemsAreClones(item, fromItem)) {
         // Set provisional item, which will be committed in recursiveUpdateForCommit.
         m_provisionalItem = item;
 
         const HistoryItemVector& childItems = item->children();
 
         int size = childItems.size();
+
         for (int i = 0; i < size; ++i) {
             String childFrameName = childItems[i]->target();
             HistoryItem* fromChildItem = fromItem->childItemWithTarget(childFrameName);
             ASSERT(fromChildItem);
             Frame* childFrame = m_frame->tree()->child(childFrameName);
             ASSERT(childFrame);
             childFrame->loader()->history()->recursiveSetProvisionalItem(childItems[i].get(), fromChildItem, type);
         }
     }
 }
@@ skipping 18 matching lines @@
             ASSERT(childFrame);
             childFrame->loader()->history()->recursiveGoToItem(childItems[i].get(), fromChildItem, type);
         }
     } else {
         m_frame->loader()->loadItem(item, type);
     }
 }
 
 bool HistoryController::itemsAreClones(HistoryItem* item1, HistoryItem* item2) const
 {
-    // It appears that one of the items can be null in release builds, leading
-    // to the crashes seen in http://webkit.org/b/52819.  For now, try to
-    // narrow it down with a more specific crash.
-    if (!item1)
-        CRASH();
-    if (!item2)
-        CRASH();
-
     // If the item we're going to is a clone of the item we're at, then we do
     // not need to load it again.  The current frame tree and the frame tree
     // snapshot in the item have to match.
     // Note: Some clients treat a navigation to the current history item as
     // a reload.  Thus, if item1 and item2 are the same, we need to create a
     // new document and should not consider them clones.
     // (See http://webkit.org/b/35532 for details.)
     return item1 != item2
         && item1->itemSequenceNumber() == item2->itemSequenceNumber()
         && currentFramesMatchItem(item1)
@@ skipping 94 matching lines @@
     if (!m_currentItem)
         return;
 
     if (!urlString.isEmpty())
         m_currentItem->setURLString(urlString);
     m_currentItem->setTitle(title);
     m_currentItem->setStateObject(stateObject);
 }
 
 } // namespace WebCore