2006-10-07 Andrew Wellington <proton@wiretapped.net>

        Reviewed by Eric.

        Bug 10837: REGRESSION: Yahoo New Charts Crashes WebKit
        http://bugzilla.opendarwin.org/show_bug.cgi?id=10837

        Return null when there is no frame. This matches Firefox.

        * bindings/js/kjs_html.cpp:
        (KJS::JSHTMLDocument::getValueProperty):

2006-10-07  Andrew Wellington  <proton@wiretapped.net>

        Reviewed by Eric.

        Test for http://bugzilla.opendarwin.org/show_bug.cgi?id=10837
        Bug 10837: REGRESSION: Yahoo New Charts Crashes WebKit

        * fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.checksum: Added.
        * fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.png: Added.
        * fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.txt: Added.
        * fast/dom/HTMLDocument/frameless-location-bugzilla10837.html: Added.



Canonical link: https://commits.webkit.org/14174@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@16881 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog

@@ -1,3 +1,15 @@
+2006-10-07  Andrew Wellington  <proton@wiretapped.net>
+
+        Reviewed by Eric.
+
+        Test for http://bugzilla.opendarwin.org/show_bug.cgi?id=10837
+        Bug 10837: REGRESSION: Yahoo New Charts Crashes WebKit
+
+        * fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.checksum: Added.
+        * fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.png: Added.
+        * fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.txt: Added.
+        * fast/dom/HTMLDocument/frameless-location-bugzilla10837.html: Added.
+
 2006-10-05  Alexey Proskuryakov  <ap@nypop.com>
 
         Reviewed by Darin.

LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.checksum

@@ -0,0 +1 @@
+c07a88de7552db9f0a9b1c21643f8c52

LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837-expected.txt

@@ -0,0 +1,20 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderFrameSet {FRAMESET} at (0,0) size 800x600
+      RenderFrame {FRAME} at (0,0) size 398x600
+        layer at (0,0) size 396x596
+          RenderView at (0,0) size 396x596
+        layer at (0,0) size 396x596
+          RenderBlock {HTML} at (0,0) size 396x596
+            RenderBody {BODY} at (8,8) size 380x580
+              RenderBlock {DIV} at (0,0) size 380x18
+                RenderText {#text} at (0,0) size 61x18
+                  text run at (0,0) width 61: "PASSED"
+      RenderFrame {FRAME} at (402,0) size 398x600
+        layer at (0,0) size 396x596
+          RenderView at (0,0) size 396x596
+        layer at (0,0) size 396x8
+          RenderBlock {HTML} at (0,0) size 396x8
+            RenderBody {BODY} at (8,8) size 380x0

LayoutTests/fast/dom/HTMLDocument/frameless-location-bugzilla10837.html

@@ -0,0 +1,15 @@
+<frameset cols="1,1">
+    <frame src="data:text/html,
+        <div id='result'>
+        FAILED
+        </div>
+        <script>
+            var f = parent.frames[1];
+            var d = f.document;
+            f.location = 'data:text/html,foo';
+            var test = d.location;
+            document.getElementById('result').innerHTML = 'PASSED';
+        </script>
+    ">
+    <frame src="about:blank">
+</frameset>

WebCore/ChangeLog

@@ -1,3 +1,15 @@
+2006-10-07  Andrew Wellington  <proton@wiretapped.net>
+
+        Reviewed by Eric.
+
+        Bug 10837: REGRESSION: Yahoo New Charts Crashes WebKit
+        http://bugzilla.opendarwin.org/show_bug.cgi?id=10837
+
+        Return null when there is no frame. This matches Firefox.
+
+        * bindings/js/kjs_html.cpp:
+        (KJS::JSHTMLDocument::getValueProperty):
+
 2006-10-07  David Hyatt  <hyatt@apple.com>
 
         Implement scroll corner painting (a white rect fill) for overflow areas to cover up

WebCore/bindings/js/kjs_html.cpp

@@ -251,6 +251,8 @@ JSValue *JSHTMLDocument::getValueProperty(ExecState* exec, int token) const
   case Body:
     return toJS(exec, body);
   case Location:
+    if (!frame)
+      return jsNull();
     if (Window* win = Window::retrieveWindow(frame))
       return win->location();
     return jsUndefined();