Merge 97087 - ScriptController::executeIfJavaScriptURL gets confused by synchronous frame loads

Source/WebCore/loader/DocumentWriter.cpp

Index: Source/WebCore/loader/DocumentWriter.cpp
===================================================================
--- Source/WebCore/loader/DocumentWriter.cpp	(revision 97088)
+++ Source/WebCore/loader/DocumentWriter.cpp	(working copy)
@@ -64,10 +64,10 @@
 // This is only called by ScriptController::executeIfJavaScriptURL
 // and always contains the result of evaluating a javascript: url.
 // This is the <iframe src="javascript:'html'"> case.
-void DocumentWriter::replaceDocument(const String& source)
+void DocumentWriter::replaceDocument(const String& source, Document* ownerDocument)
 {
     m_frame->loader()->stopAllLoaders();
-    begin(m_frame->document()->url(), true, InheritSecurityOrigin);
+    begin(m_frame->document()->url(), true, ownerDocument);
 
     if (!source.isNull()) {
         if (!m_hasReceivedSomeData) {
@@ -106,10 +106,8 @@
     return DOMImplementation::createDocument(m_mimeType, m_frame, url, m_frame->inViewSourceMode());
 }
 
-void DocumentWriter::begin(const KURL& urlReference, bool dispatch, SecurityOriginSource originSource)
+void DocumentWriter::begin(const KURL& urlReference, bool dispatch, Document* ownerDocument)
 {
-    RefPtr<Document> oldDocument = m_frame->document();
-
     // We grab a local copy of the URL because it's easy for callers to supply
     // a URL that will be deallocated during the execution of this function.
     // For example, see <https://bugs.webkit.org/show_bug.cgi?id=66360>.
@@ -137,9 +135,9 @@
 
     if (m_decoder)
         document->setDecoder(m_decoder.get());
-    if (originSource == InheritSecurityOrigin) {
-        document->setCookieURL(oldDocument->cookieURL());
-        document->setSecurityOrigin(oldDocument->securityOrigin());
+    if (ownerDocument) {
+        document->setCookieURL(ownerDocument->cookieURL());
+        document->setSecurityOrigin(ownerDocument->securityOrigin());
     }
 
     m_frame->domWindow()->setURL(document->url());