Forgot to commit a file.

layout/generic/nsFrameFrame.cpp

@@ -648,11 +648,52 @@ nsHTMLFrameInnerFrame::CreateWebShell(nsIPresContext& aPresContext,
   nsIContent* content;
   GetParentContent(content);
 
-  rv = nsComponentManager::CreateInstance(kWebShellCID, nsnull, kIWebShellIID,
+  mWebShell = nsnull;
-                                    (void**)&mWebShell);
+
-  if (NS_OK != rv) {
+#ifdef INCLUDE_XUL
-    NS_ASSERTION(0, "could not create web widget");
+  nsCOMPtr<nsISupports> presContainer;
-    return rv;
+  aPresContext.GetContainer(getter_AddRefs(presContainer));
+  if (presContainer) {
+    nsCOMPtr<nsIWebShell> parentShell;
+    parentShell = do_QueryInterface(presContainer);
+    if (parentShell) {
+      nsWebShellType shellType;
+      parentShell->GetWebShellType(shellType);
+      if (shellType == nsWebShellChrome) {
+        nsCOMPtr<nsIWebShellContainer> parentContainer;
+        parentContainer = do_QueryInterface(presContainer);
+        if (parentContainer) {
+          parentContainer->ChildShellAdded(&mWebShell, content);
+          if (mWebShell) {
+            nsIAtom* typeAtom = NS_NewAtom("type");
+	          nsAutoString value;
+	          content->GetAttribute(kNameSpaceID_None, typeAtom, value);
+	          if (value.EqualsIgnoreCase("content")) {
+		          // The web shell's type is content.
+		          mWebShell->SetWebShellType(nsWebShellContent);
+            }
+            else {
+              // Inherit our type from our parent webshell.  If it is
+		          // chrome, we'll be chrome.  If it is content, we'll be
+		          // content.
+		          nsWebShellType parentType;
+		          parentShell->GetWebShellType(parentType);
+		          mWebShell->SetWebShellType(parentType);
+            }
+          }
+        }
+      }
+    }
+  }    
+#endif // INCLUDE_XUL
+
+  if (mWebShell == nsnull) {
+    rv = nsComponentManager::CreateInstance(kWebShellCID, nsnull, kIWebShellIID,
+                                      (void**)&mWebShell);
+    if (NS_OK != rv) {
+      NS_ASSERTION(0, "could not create web widget");
+      return rv;
+    }
   }
 
   // pass along marginwidth, marginheight, scrolling so sub document can use it
@@ -693,49 +734,6 @@ nsHTMLFrameInnerFrame::CreateWebShell(nsIPresContext& aPresContext,
         mWebShell->SetPrefs(outerPrefs);
         NS_RELEASE(outerPrefs);
       }
-      
-#ifdef INCLUDE_XUL
-			// Determine whether or not the frame is content or chrome.
-			nsIAtom* typeAtom = NS_NewAtom("type");
-			nsAutoString value;
-			content->GetAttribute(kNameSpaceID_None, typeAtom, value);
-			if (value.EqualsIgnoreCase("content"))
-			{
-				// The web shell's type is content.
-				mWebShell->SetWebShellType(nsWebShellContent);
-
-        // In this specific circumstance, where a content sandbox
-        // has been added underneath a chrome shell, we should 
-        // send a notification to the web shell container, which
-        // will pass the notification up the chain to our root
-        // container.  The root container can determine if this
-        // content shell matches any shells that it has asynchronous load
-        // information for, and if so, the root container can handle
-        // the linkage between this new shell and the original
-        // opener shell.
-
-        // Note that this notification will never fire with normal HTML
-        // pages.  This can only fire on a sandboxed shell in a XUL
-        // document.
-        nsIWebShellContainer* outerContainer = nsnull;
-        container->QueryInterface(kIWebShellContainerIID, (void**) &outerContainer);
-        if (nsnull != outerContainer) {
-          PRBool handled;
-          outerContainer->ChildShellAdded(mWebShell, content, handled); 
-          NS_RELEASE(outerContainer);
-        }
-			}
-			else
-			{
-				// Inherit our type from our parent webshell.  If it is
-				// chrome, we'll be chrome.  If it is content, we'll be
-				// content.
-				nsWebShellType parentType;
-				outerShell->GetWebShellType(parentType);
-				mWebShell->SetWebShellType(parentType);
-			}
-#endif // INCLUDE_XUL
-
       NS_RELEASE(outerShell);
     }
     NS_RELEASE(container);
@@ -812,6 +810,11 @@ nsHTMLFrameInnerFrame::Reflow(nsIPresContext&          aPresContext,
       if (nsnull == mWebShell) {
         nsSize  maxSize(aReflowState.availableWidth, aReflowState.availableHeight);
         rv = CreateWebShell(aPresContext, maxSize);
+#ifdef INCLUDE_XUL
+        // The URL can be destructively altered when a content shell is made.
+        // Refetch it to ensure we have the actual URL to load.
+        hasURL = GetURL(content, url);
+#endif // INCLUDE_XUL
       }
 
       if (nsnull != mWebShell) {

layout/html/document/src/nsFrameFrame.cpp

@@ -648,11 +648,52 @@ nsHTMLFrameInnerFrame::CreateWebShell(nsIPresContext& aPresContext,
   nsIContent* content;
   GetParentContent(content);
 
-  rv = nsComponentManager::CreateInstance(kWebShellCID, nsnull, kIWebShellIID,
+  mWebShell = nsnull;
-                                    (void**)&mWebShell);
+
-  if (NS_OK != rv) {
+#ifdef INCLUDE_XUL
-    NS_ASSERTION(0, "could not create web widget");
+  nsCOMPtr<nsISupports> presContainer;
-    return rv;
+  aPresContext.GetContainer(getter_AddRefs(presContainer));
+  if (presContainer) {
+    nsCOMPtr<nsIWebShell> parentShell;
+    parentShell = do_QueryInterface(presContainer);
+    if (parentShell) {
+      nsWebShellType shellType;
+      parentShell->GetWebShellType(shellType);
+      if (shellType == nsWebShellChrome) {
+        nsCOMPtr<nsIWebShellContainer> parentContainer;
+        parentContainer = do_QueryInterface(presContainer);
+        if (parentContainer) {
+          parentContainer->ChildShellAdded(&mWebShell, content);
+          if (mWebShell) {
+            nsIAtom* typeAtom = NS_NewAtom("type");
+	          nsAutoString value;
+	          content->GetAttribute(kNameSpaceID_None, typeAtom, value);
+	          if (value.EqualsIgnoreCase("content")) {
+		          // The web shell's type is content.
+		          mWebShell->SetWebShellType(nsWebShellContent);
+            }
+            else {
+              // Inherit our type from our parent webshell.  If it is
+		          // chrome, we'll be chrome.  If it is content, we'll be
+		          // content.
+		          nsWebShellType parentType;
+		          parentShell->GetWebShellType(parentType);
+		          mWebShell->SetWebShellType(parentType);
+            }
+          }
+        }
+      }
+    }
+  }    
+#endif // INCLUDE_XUL
+
+  if (mWebShell == nsnull) {
+    rv = nsComponentManager::CreateInstance(kWebShellCID, nsnull, kIWebShellIID,
+                                      (void**)&mWebShell);
+    if (NS_OK != rv) {
+      NS_ASSERTION(0, "could not create web widget");
+      return rv;
+    }
   }
 
   // pass along marginwidth, marginheight, scrolling so sub document can use it
@@ -693,49 +734,6 @@ nsHTMLFrameInnerFrame::CreateWebShell(nsIPresContext& aPresContext,
         mWebShell->SetPrefs(outerPrefs);
         NS_RELEASE(outerPrefs);
       }
-      
-#ifdef INCLUDE_XUL
-			// Determine whether or not the frame is content or chrome.
-			nsIAtom* typeAtom = NS_NewAtom("type");
-			nsAutoString value;
-			content->GetAttribute(kNameSpaceID_None, typeAtom, value);
-			if (value.EqualsIgnoreCase("content"))
-			{
-				// The web shell's type is content.
-				mWebShell->SetWebShellType(nsWebShellContent);
-
-        // In this specific circumstance, where a content sandbox
-        // has been added underneath a chrome shell, we should 
-        // send a notification to the web shell container, which
-        // will pass the notification up the chain to our root
-        // container.  The root container can determine if this
-        // content shell matches any shells that it has asynchronous load
-        // information for, and if so, the root container can handle
-        // the linkage between this new shell and the original
-        // opener shell.
-
-        // Note that this notification will never fire with normal HTML
-        // pages.  This can only fire on a sandboxed shell in a XUL
-        // document.
-        nsIWebShellContainer* outerContainer = nsnull;
-        container->QueryInterface(kIWebShellContainerIID, (void**) &outerContainer);
-        if (nsnull != outerContainer) {
-          PRBool handled;
-          outerContainer->ChildShellAdded(mWebShell, content, handled); 
-          NS_RELEASE(outerContainer);
-        }
-			}
-			else
-			{
-				// Inherit our type from our parent webshell.  If it is
-				// chrome, we'll be chrome.  If it is content, we'll be
-				// content.
-				nsWebShellType parentType;
-				outerShell->GetWebShellType(parentType);
-				mWebShell->SetWebShellType(parentType);
-			}
-#endif // INCLUDE_XUL
-
       NS_RELEASE(outerShell);
     }
     NS_RELEASE(container);
@@ -812,6 +810,11 @@ nsHTMLFrameInnerFrame::Reflow(nsIPresContext&          aPresContext,
       if (nsnull == mWebShell) {
         nsSize  maxSize(aReflowState.availableWidth, aReflowState.availableHeight);
         rv = CreateWebShell(aPresContext, maxSize);
+#ifdef INCLUDE_XUL
+        // The URL can be destructively altered when a content shell is made.
+        // Refetch it to ensure we have the actual URL to load.
+        hasURL = GetURL(content, url);
+#endif // INCLUDE_XUL
       }
 
       if (nsnull != mWebShell) {