DescriptionMerge 95471 - [Chromium] Crash after magic iframe transfer for Pepper/NaCl plugins.
https://bugs.webkit.org/show_bug.cgi?id=68267
Make adoptNode() to not enable live iframe transfer when the iframe's subtree contains plugins.
Reviewed by Adam Barth.
Source/WebCore:
Test: fast/frames/iframe-reparenting-embed-elements.html
* dom/Document.cpp:
(WebCore::Document::adoptNode):
* html/HTMLFrameElementBase.cpp:
(WebCore::hasPluginElements):
(WebCore::HTMLFrameElementBase::canRemainAliveOnRemovalFromTree):
* html/HTMLFrameElementBase.h:
LayoutTests:
* fast/frames/iframe-reparenting-embed-elements-expected.txt: Added.
* fast/frames/iframe-reparenting-embed-elements.html: Added.
* fast/frames/resources/iframe-reparenting-embed-frame1.html: Added.
* fast/frames/resources/iframe-reparenting-embed-iframe.html: Added.
TBR=dimich@chromium.org
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=95657
Patch Set 1 #
Messages
Total messages: 1 (0 generated)
|