From e98fd07ffba382273e07d161edd486247afd0f86 Mon Sep 17 00:00:00 2001
From: Scott Violet <sky@chromium.org>
Date: Wed, 28 Jan 2015 19:47:26 -0800
Subject: [PATCH] Fixes crash in HTMLIFrameElement and exposes
 HTMLIFrameElement::src

HTMLIFrameElement was adding the observer in navigateView. If the same
HTMLIFrameElement navigated multiple times HTMLIFrameElement would
attach itself as an observer more than once. ObserverList doesn't like
this.

Also adds src as an attribute of HTMLIFrameElement so that I can do:
iframe.src = xxx
in script

R=abarth@chromium.org

Review URL: https://codereview.chromium.org/885783002
---
 engine/core/html/HTMLIFrameElement.cpp | 5 +++--
 engine/core/html/HTMLIFrameElement.idl | 2 ++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/engine/core/html/HTMLIFrameElement.cpp b/engine/core/html/HTMLIFrameElement.cpp
index d47b2f5048e..90cb6736f57 100644
--- a/engine/core/html/HTMLIFrameElement.cpp
+++ b/engine/core/html/HTMLIFrameElement.cpp
@@ -35,8 +35,10 @@ void HTMLIFrameElement::insertedInto(ContainerNode* insertionPoint)
 {
     HTMLElement::insertedInto(insertionPoint);
     if (insertionPoint->inDocument()) {
-        if (LocalFrame* frame = document().frame())
+        if (LocalFrame* frame = document().frame()) {
             m_contentView = frame->loaderClient()->createChildFrame();
+            m_contentView->AddObserver(this);
+        }
         navigateView();
     }
 }
@@ -95,7 +97,6 @@ void HTMLIFrameElement::navigateView()
     m_contentView->Embed(mojo::String::From(url.string().utf8().data()),
         mojo::GetProxy(&m_services),
         mojo::MakeProxy<mojo::ServiceProvider>(exposedServicesPipe.handle1.Pass()));
-    m_contentView->AddObserver(this);
 }
 
 }
diff --git a/engine/core/html/HTMLIFrameElement.idl b/engine/core/html/HTMLIFrameElement.idl
index 405860065b4..1a4e2309dc3 100644
--- a/engine/core/html/HTMLIFrameElement.idl
+++ b/engine/core/html/HTMLIFrameElement.idl
@@ -3,6 +3,8 @@
 // found in the LICENSE file.
 
 interface HTMLIFrameElement : HTMLElement {
+  [Reflect, URL] attribute DOMString src;
+
   [CallWith=ScriptState] any takeServicesHandle();
   [CallWith=ScriptState] any takeExposedServicesHandle();
 };