1 files changed, 24 insertions, 29 deletions

diff --git a/WebCore/html/HTMLFrameElementBase.cpp b/WebCore/html/HTMLFrameElementBase.cpp
index b967926..8cca465 100644
--- a/WebCore/html/HTMLFrameElementBase.cpp
+++ b/WebCore/html/HTMLFrameElementBase.cpp
@@ -52,9 +52,8 @@ HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Documen
     , m_scrolling(ScrollbarAuto)
     , m_marginWidth(-1)
     , m_marginHeight(-1)
-    , m_checkAttachedTimer(this, &HTMLFrameElementBase::checkAttachedTimerFired)
+    , m_checkInDocumentTimer(this, &HTMLFrameElementBase::checkInDocumentTimerFired)
     , m_viewSource(false)
-    , m_shouldOpenURLAfterAttach(false)
     , m_remainsAliveOnRemovalFromTree(false)
 {
 }
@@ -183,33 +182,31 @@ void HTMLFrameElementBase::updateOnReparenting()
 void HTMLFrameElementBase::insertedIntoDocument()
 {
     HTMLFrameOwnerElement::insertedIntoDocument();
-    
-    // We delay frame loading until after the render tree is fully constructed.
-    // Othewise, a synchronous load that executed JavaScript would see incorrect 
-    // (0) values for the frame's renderer-dependent properties, like width.
-    m_shouldOpenURLAfterAttach = true;
 
-    if (m_remainsAliveOnRemovalFromTree)
+    if (m_remainsAliveOnRemovalFromTree) {
         updateOnReparenting();
-}
-
-void HTMLFrameElementBase::removedFromDocument()
-{
-    m_shouldOpenURLAfterAttach = false;
+        setRemainsAliveOnRemovalFromTree(false);
+        return;
+    }
+    // DocumentFragments don't kick of any loads.
+    if (!document()->frame())
+        return;
 
-    HTMLFrameOwnerElement::removedFromDocument();
+    // Loads may cause synchronous javascript execution (e.g. beforeload or
+    // src=javascript), which could try to access the renderer before the normal
+    // parser machinery would call lazyAttach() and set us as needing style
+    // resolve.  Any code which expects this to be attached will resolve style
+    // before using renderer(), so this will make sure we attach in time.
+    // FIXME: Normally lazyAttach marks the renderer as attached(), but we don't
+    // want to do that here, as as callers expect to call attach() right after
+    // this and attach() will ASSERT(!attached())
+    ASSERT(!renderer()); // This recalc is unecessary if we already have a renderer.
+    lazyAttach(DoNotSetAttached);
+    setNameAndOpenURL();
 }
 
 void HTMLFrameElementBase::attach()
 {
-    if (m_shouldOpenURLAfterAttach) {
-        m_shouldOpenURLAfterAttach = false;
-        if (!m_remainsAliveOnRemovalFromTree)
-            queuePostAttachCallback(&HTMLFrameElementBase::setNameAndOpenURLCallback, this);
-    }
-
-    setRemainsAliveOnRemovalFromTree(false);
-
     HTMLFrameOwnerElement::attach();
 
     if (RenderPart* part = renderPart()) {
@@ -258,19 +255,17 @@ bool HTMLFrameElementBase::isURLAttribute(Attribute *attr) const
 
 int HTMLFrameElementBase::width() const
 {
+    document()->updateLayoutIgnorePendingStylesheets();
     if (!renderBox())
         return 0;
-
-    document()->updateLayoutIgnorePendingStylesheets();
     return renderBox()->width();
 }
 
 int HTMLFrameElementBase::height() const
 {
+    document()->updateLayoutIgnorePendingStylesheets();
     if (!renderBox())
         return 0;
-
-    document()->updateLayoutIgnorePendingStylesheets();
     return renderBox()->height();
 }
 
@@ -281,12 +276,12 @@ void HTMLFrameElementBase::setRemainsAliveOnRemovalFromTree(bool value)
     // There is a possibility that JS will do document.adoptNode() on this element but will not insert it into the tree.
     // Start the async timer that is normally stopped by attach(). If it's not stopped and fires, it'll unload the frame.
     if (value)
-        m_checkAttachedTimer.startOneShot(0);
+        m_checkInDocumentTimer.startOneShot(0);
     else
-        m_checkAttachedTimer.stop();
+        m_checkInDocumentTimer.stop();
 }
 
-void HTMLFrameElementBase::checkAttachedTimerFired(Timer<HTMLFrameElementBase>*)
+void HTMLFrameElementBase::checkInDocumentTimerFired(Timer<HTMLFrameElementBase>*)
 {
     ASSERT(!attached());
     ASSERT(m_remainsAliveOnRemovalFromTree);