Merge from Chromium at DEPS revision 30.0.1599.101
This commit was generated by merge_to_master.py.
Change-Id: Idf34fc64e5c44d60ce3290818fda14d51f53f539
diff --git a/LayoutTests/fast/events/touch/compositor-touch-hit-rects-disabled-expected.txt b/LayoutTests/fast/events/touch/compositor-touch-hit-rects-disabled-expected.txt
deleted file mode 100644
index ab22494..0000000
--- a/LayoutTests/fast/events/touch/compositor-touch-hit-rects-disabled-expected.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-This tests verifies that hit testing can be disabled.
-
-normalFlow: no rects
-
-
diff --git a/LayoutTests/fast/events/touch/compositor-touch-hit-rects-disabled.html b/LayoutTests/fast/events/touch/compositor-touch-hit-rects-disabled.html
deleted file mode 100644
index 33bcd6f..0000000
--- a/LayoutTests/fast/events/touch/compositor-touch-hit-rects-disabled.html
+++ /dev/null
@@ -1,28 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<link rel="stylesheet" href="resources/compositor-touch-hit-rects.css">
-<style>
-</style>
-</head>
-<body>
-<script>
-if (window.internals) {
- window.internals.settings.setCompositorTouchHitTesting(false);
-}
-</script>
-<p id="description">
-This tests verifies that hit testing can be disabled.
-</p>
-
-<div id="tests">
- <div class="testcase" id="normalFlow">
- Normal
- <span>flow</span>.
- </div>
-</div>
-
-<div id="console"></div>
-<div style="height: 1000px;"></div>
-<script src="resources/compositor-touch-hit-rects.js"></script>
-</body>
diff --git a/Source/core/xml/XMLHttpRequest.cpp b/Source/core/xml/XMLHttpRequest.cpp
index e65a4a7..6775b31 100644
--- a/Source/core/xml/XMLHttpRequest.cpp
+++ b/Source/core/xml/XMLHttpRequest.cpp
@@ -450,7 +450,9 @@
void XMLHttpRequest::open(const String& method, const KURL& url, bool async, ExceptionState& es)
{
- internalAbort();
+ if (!internalAbort())
+ return;
+
State previousState = m_state;
m_state = UNSENT;
m_error = false;
@@ -783,7 +785,8 @@
bool sendFlag = m_loader;
- internalAbort();
+ if (!internalAbort())
+ return;
clearResponseBuffers();
@@ -806,7 +809,7 @@
}
}
-void XMLHttpRequest::internalAbort()
+bool XMLHttpRequest::internalAbort()
{
bool hadLoader = m_loader;
@@ -816,8 +819,19 @@
m_receivedLength = 0;
if (hadLoader) {
- m_loader->cancel();
- m_loader = 0;
+ // Cancelling the ThreadableLoader m_loader may result in calling
+ // window.onload synchronously. If such an onload handler contains
+ // open() call on the same XMLHttpRequest object, reentry happens. If
+ // m_loader is left to be non 0, internalAbort() call for the inner
+ // open() makes an extra dropProtection() call (when we're back to the
+ // outer open(), we'll call dropProtection()). To avoid that, clears
+ // m_loader before calling cancel.
+ //
+ // If, window.onload contains open() and send(), m_loader will be set to
+ // non 0 value. So, we cannot continue the outer open(). In such case,
+ // just abort the outer open() by returning false.
+ RefPtr<ThreadableLoader> loader = m_loader.release();
+ loader->cancel();
}
m_decoder = 0;
@@ -826,6 +840,8 @@
if (hadLoader)
dropProtectionSoon();
+
+ return !m_loader;
}
void XMLHttpRequest::clearResponse()
@@ -1186,7 +1202,8 @@
{
// internalAbort() calls dropProtection(), which may release the last reference.
RefPtr<XMLHttpRequest> protect(this);
- internalAbort();
+ if (!internalAbort())
+ return;
clearResponse();
clearRequest();
diff --git a/Source/core/xml/XMLHttpRequest.h b/Source/core/xml/XMLHttpRequest.h
index fde3a84..74b45cc 100644
--- a/Source/core/xml/XMLHttpRequest.h
+++ b/Source/core/xml/XMLHttpRequest.h
@@ -176,7 +176,7 @@
void callReadyStateChangeListener();
void dropProtectionSoon();
void dropProtection(Timer<XMLHttpRequest>* = 0);
- void internalAbort();
+ bool internalAbort();
void clearResponse();
void clearResponseBuffers();
void clearRequest();
