1 files changed, 51 insertions, 36 deletions

diff --git a/Source/WebCore/html/HTMLEmbedElement.cpp b/Source/WebCore/html/HTMLEmbedElement.cpp
index d014fa4d2..95291038a 100644
--- a/Source/WebCore/html/HTMLEmbedElement.cpp
+++ b/Source/WebCore/html/HTMLEmbedElement.cpp
@@ -24,7 +24,6 @@
 #include "config.h"
 #include "HTMLEmbedElement.h"
 
-#include "Attribute.h"
 #include "CSSPropertyNames.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -45,37 +44,43 @@ namespace WebCore {
 using namespace HTMLNames;
 
 inline HTMLEmbedElement::HTMLEmbedElement(const QualifiedName& tagName, Document& document, bool createdByParser)
-    : HTMLPlugInImageElement(tagName, document, createdByParser, ShouldPreferPlugInsForImages)
+    : HTMLPlugInImageElement(tagName, document, createdByParser)
 {
     ASSERT(hasTagName(embedTag));
 }
 
-PassRefPtr<HTMLEmbedElement> HTMLEmbedElement::create(const QualifiedName& tagName, Document& document, bool createdByParser)
+Ref<HTMLEmbedElement> HTMLEmbedElement::create(const QualifiedName& tagName, Document& document, bool createdByParser)
 {
-    return adoptRef(new HTMLEmbedElement(tagName, document, createdByParser));
+    return adoptRef(*new HTMLEmbedElement(tagName, document, createdByParser));
 }
 
-static inline RenderWidget* findWidgetRenderer(const Node* n) 
+Ref<HTMLEmbedElement> HTMLEmbedElement::create(Document& document)
 {
-    if (!n->renderer())
-        do
-            n = n->parentNode();
-        while (n && !n->hasTagName(objectTag));
+    return adoptRef(*new HTMLEmbedElement(embedTag, document, false));
+}
+
+static inline RenderWidget* findWidgetRenderer(const Node* node)
+{
+    if (!node->renderer()) {
+        do {
+            node = node->parentNode();
+        } while (node && !is<HTMLObjectElement>(*node));
+    }
 
-    if (n && n->renderer() && n->renderer()->isWidget())
-        return toRenderWidget(n->renderer());
+    if (node && is<RenderWidget>(node->renderer()))
+        return downcast<RenderWidget>(node->renderer());
 
-    return 0;
+    return nullptr;
 }
 
-RenderWidget* HTMLEmbedElement::renderWidgetForJSBindings() const
+RenderWidget* HTMLEmbedElement::renderWidgetLoadingPlugin() const
 {
     FrameView* view = document().view();
-    if (!view || (!view->isInLayout() && !view->isPainting())) {
+    if (!view || (!view->isInRenderTreeLayout() && !view->isPainting())) {
         // Needs to load the plugin immediatedly because this function is called
         // when JavaScript code accesses the plugin.
         // FIXME: <rdar://16893708> Check if dispatching events here is safe.
-        document().updateLayoutIgnorePendingStylesheets(Document::RunPostLayoutTasksSynchronously);
+        document().updateLayoutIgnorePendingStylesheets(Document::RunPostLayoutTasks::Synchronously);
     }
     return findWidgetRenderer(this);
 }
@@ -90,7 +95,7 @@ bool HTMLEmbedElement::isPresentationAttribute(const QualifiedName& name) const
 void HTMLEmbedElement::collectStyleForPresentationAttribute(const QualifiedName& name, const AtomicString& value, MutableStyleProperties& style)
 {
     if (name == hiddenAttr) {
-        if (equalIgnoringCase(value, "yes") || equalIgnoringCase(value, "true")) {
+        if (equalLettersIgnoringASCIICase(value, "yes") || equalLettersIgnoringASCIICase(value, "true")) {
             addPropertyToPresentationAttributeStyle(style, CSSPropertyWidth, 0, CSSPrimitiveValue::CSS_PX);
             addPropertyToPresentationAttributeStyle(style, CSSPropertyHeight, 0, CSSPrimitiveValue::CSS_PX);
         }
@@ -101,20 +106,23 @@ void HTMLEmbedElement::collectStyleForPresentationAttribute(const QualifiedName&
 void HTMLEmbedElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
 {
     if (name == typeAttr) {
-        m_serviceType = value.string().lower();
-        size_t pos = m_serviceType.find(";");
-        if (pos != notFound)
-            m_serviceType = m_serviceType.left(pos);
-    } else if (name == codeAttr)
+        m_serviceType = value.string().left(value.find(';')).convertToASCIILowercase();
+        // FIXME: The only difference between this and HTMLObjectElement's corresponding
+        // code is that HTMLObjectElement does setNeedsWidgetUpdate(true). Consider moving
+        // this up to the HTMLPlugInImageElement to be shared.
+    } else if (name == codeAttr) {
         m_url = stripLeadingAndTrailingHTMLSpaces(value);
-    else if (name == srcAttr) {
+        // FIXME: Why no call to the image loader?
+        // FIXME: If both code and src attributes are specified, last one parsed/changed wins. That can't be right!
+    } else if (name == srcAttr) {
         m_url = stripLeadingAndTrailingHTMLSpaces(value);
         document().updateStyleIfNeeded();
         if (renderer() && isImageType()) {
             if (!m_imageLoader)
-                m_imageLoader = adoptPtr(new HTMLImageLoader(this));
+                m_imageLoader = std::make_unique<HTMLImageLoader>(*this);
             m_imageLoader->updateFromElementIgnoringPreviousError();
         }
+        // FIXME: If both code and src attributes are specified, last one parsed/changed wins. That can't be right!
     } else
         HTMLPlugInImageElement::parseAttribute(name, value);
 }
@@ -132,7 +140,7 @@ void HTMLEmbedElement::parametersForPlugin(Vector<String>& paramNames, Vector<St
 
 // FIXME: This should be unified with HTMLObjectElement::updateWidget and
 // moved down into HTMLPluginImageElement.cpp
-void HTMLEmbedElement::updateWidget(PluginCreationOption pluginCreationOption)
+void HTMLEmbedElement::updateWidget(CreatePlugins createPlugins)
 {
     ASSERT(!renderEmbeddedObject()->isPluginUnavailable());
     ASSERT(needsWidgetUpdate());
@@ -149,7 +157,7 @@ void HTMLEmbedElement::updateWidget(PluginCreationOption pluginCreationOption)
     // FIXME: It's sadness that we have this special case here.
     //        See http://trac.webkit.org/changeset/25128 and
     //        plugins/netscape-plugin-setwindow-size.html
-    if (pluginCreationOption == CreateOnlyNonNetscapePlugins && wouldLoadAsNetscapePlugin(m_url, m_serviceType)) {
+    if (createPlugins == CreatePlugins::No && wouldLoadAsPlugIn(m_url, m_serviceType)) {
         // Ensure updateWidget() is called again during layout to create the Netscape plug-in.
         setNeedsWidgetUpdate(true);
         return;
@@ -160,44 +168,51 @@ void HTMLEmbedElement::updateWidget(PluginCreationOption pluginCreationOption)
     Vector<String> paramValues;
     parametersForPlugin(paramNames, paramValues);
 
-    Ref<HTMLEmbedElement> protect(*this); // Loading the plugin might remove us from the document.
+    Ref<HTMLEmbedElement> protectedThis(*this); // Loading the plugin might remove us from the document.
     bool beforeLoadAllowedLoad = guardedDispatchBeforeLoadEvent(m_url);
     if (!beforeLoadAllowedLoad) {
-        if (document().isPluginDocument()) {
+        if (is<PluginDocument>(document())) {
             // Plugins inside plugin documents load differently than other plugins. By the time
             // we are here in a plugin document, the load of the plugin (which is the plugin document's
             // main resource) has already started. We need to explicitly cancel the main resource load here.
-            toPluginDocument(&document())->cancelManualPluginLoad();
+            downcast<PluginDocument>(document()).cancelManualPluginLoad();
         }
         return;
     }
     if (!renderer()) // Do not load the plugin if beforeload removed this element or its renderer.
         return;
 
+    // beforeLoad could have changed the document. Make sure the URL is still safe to load.
+    if (!allowedToLoadFrameURL(m_url))
+        return;
+
     // FIXME: beforeLoad could have detached the renderer!  Just like in the <object> case above.
     requestObject(m_url, m_serviceType, paramNames, paramValues);
 }
 
 bool HTMLEmbedElement::rendererIsNeeded(const RenderStyle& style)
 {
+    if (!hasAttributeWithoutSynchronization(typeAttr) && !hasAttributeWithoutSynchronization(srcAttr))
+        return false;
+
     if (isImageType())
         return HTMLPlugInImageElement::rendererIsNeeded(style);
 
     // If my parent is an <object> and is not set to use fallback content, I
     // should be ignored and not get a renderer.
-    ContainerNode* p = parentNode();
-    if (p && p->hasTagName(objectTag)) {
-        if (!p->renderer())
+    ContainerNode* parent = parentNode();
+    if (is<HTMLObjectElement>(parent)) {
+        if (!parent->renderer())
             return false;
-        if (!toHTMLObjectElement(p)->useFallbackContent()) {
-            ASSERT(!p->renderer()->isEmbeddedObject());
+        if (!downcast<HTMLObjectElement>(*parent).useFallbackContent()) {
+            ASSERT(!parent->renderer()->isEmbeddedObject());
             return false;
         }
     }
 
 #if ENABLE(DASHBOARD_SUPPORT)
     // Workaround for <rdar://problem/6642221>.
-    if (document().frame()->settings().usesDashboardBackwardCompatibilityMode())
+    if (document().settings().usesDashboardBackwardCompatibilityMode())
         return true;
 #endif
 
@@ -211,14 +226,14 @@ bool HTMLEmbedElement::isURLAttribute(const Attribute& attribute) const
 
 const AtomicString& HTMLEmbedElement::imageSourceURL() const
 {
-    return getAttribute(srcAttr);
+    return attributeWithoutSynchronization(srcAttr);
 }
 
 void HTMLEmbedElement::addSubresourceAttributeURLs(ListHashSet<URL>& urls) const
 {
     HTMLPlugInImageElement::addSubresourceAttributeURLs(urls);
 
-    addSubresourceURL(urls, document().completeURL(getAttribute(srcAttr)));
+    addSubresourceURL(urls, document().completeURL(attributeWithoutSynchronization(srcAttr)));
 }
 
 }