Imported WebKit commit 8eb048315f36fa33731f28694630fe4a3c2cbc99 (http://svn.webkit.org/repository/webkit/trunk@135602)

New snapshot that fixes various bugs

Change-Id: Icb6ce541a26a9f500d087821ce4b83a8d8a5474a
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>

1 files changed, 3 insertions, 18 deletions

diff --git a/Source/WebCore/html/HTMLPlugInImageElement.cpp b/Source/WebCore/html/HTMLPlugInImageElement.cpp
index f1720b8d5..b809a1340 100644
--- a/Source/WebCore/html/HTMLPlugInImageElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInImageElement.cpp
@@ -88,28 +88,13 @@ bool HTMLPlugInImageElement::isImageType()
 // depending on <param> values. 
 bool HTMLPlugInImageElement::allowedToLoadFrameURL(const String& url)
 {
-    ASSERT(document());
-    ASSERT(document()->frame());
-    if (document()->frame()->page()->subframeCount() >= Page::maxNumberOfFrames)
-        return false;
-
     KURL completeURL = document()->completeURL(url);
-    
+
     if (contentFrame() && protocolIsJavaScript(completeURL)
         && !document()->securityOrigin()->canAccess(contentDocument()->securityOrigin()))
         return false;
-    
-    // We allow one level of self-reference because some sites depend on that.
-    // But we don't allow more than one.
-    bool foundSelfReference = false;
-    for (Frame* frame = document()->frame(); frame; frame = frame->tree()->parent()) {
-        if (equalIgnoringFragmentIdentifier(frame->document()->url(), completeURL)) {
-            if (foundSelfReference)
-                return false;
-            foundSelfReference = true;
-        }
-    }
-    return true;
+
+    return document()->frame()->isURLAllowed(completeURL);
 }
 
 // We don't use m_url, or m_serviceType as they may not be the final values