From cf30596d4f95577a8e0565f9bc3f842dfc8893db Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Thu, 14 Mar 2013 22:38:27 -0700
Subject: [PATCH] Bug 850517 - Propagate ifr.setAttribute('name', 'foo') to the
 docshell. r=bz

This is correct per-spec. From HTML5's "The iframe element":

"Whenever the name attribute is set, the nested browsing context's name
must be changed to the new value. If the attribute is removed, the
browsing context name must be set to the empty string."
---
 .../content/src/nsGenericHTMLFrameElement.cpp | 29 +++++++++++++++++++
 .../content/src/nsGenericHTMLFrameElement.h   |  4 ++-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/content/html/content/src/nsGenericHTMLFrameElement.cpp b/content/html/content/src/nsGenericHTMLFrameElement.cpp
index 214caaa802d5..ae7ef1129876 100644
--- a/content/html/content/src/nsGenericHTMLFrameElement.cpp
+++ b/content/html/content/src/nsGenericHTMLFrameElement.cpp
@@ -227,6 +227,35 @@ nsGenericHTMLFrameElement::SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
     // Don't propagate error here. The attribute was successfully set, that's
     // what we should reflect.
     LoadSrc();
+  } else if (aNameSpaceID == kNameSpaceID_None && aName == nsGkAtoms::name) {
+    // Propagate "name" to the docshell to make browsing context names live,
+    // per HTML5.
+    nsIDocShell *docShell = mFrameLoader ? mFrameLoader->GetExistingDocShell()
+                                         : nullptr;
+    if (docShell) {
+      docShell->SetName(PromiseFlatString(aValue).get());
+    }
+  }
+
+  return NS_OK;
+}
+
+nsresult
+nsGenericHTMLFrameElement::UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,
+                                     bool aNotify)
+{
+  // Invoke on the superclass.
+  nsresult rv = nsGenericHTMLElement::UnsetAttr(aNameSpaceID, aAttribute, aNotify);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (aNameSpaceID == kNameSpaceID_None && aAttribute == nsGkAtoms::name) {
+    // Propagate "name" to the docshell to make browsing context names live,
+    // per HTML5.
+    nsIDocShell *docShell = mFrameLoader ? mFrameLoader->GetExistingDocShell()
+                                         : nullptr;
+    if (docShell) {
+      docShell->SetName(EmptyString().get());
+    }
   }
 
   return NS_OK;
diff --git a/content/html/content/src/nsGenericHTMLFrameElement.h b/content/html/content/src/nsGenericHTMLFrameElement.h
index cef2f8254eee..2833e6dcc9a2 100644
--- a/content/html/content/src/nsGenericHTMLFrameElement.h
+++ b/content/html/content/src/nsGenericHTMLFrameElement.h
@@ -53,7 +53,9 @@ public:
   }
   virtual nsresult SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                            nsIAtom* aPrefix, const nsAString& aValue,
-                           bool aNotify);
+                           bool aNotify) MOZ_OVERRIDE;
+  virtual nsresult UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,
+                             bool aNotify) MOZ_OVERRIDE;
   virtual void DestroyContent();
 
   nsresult CopyInnerTo(mozilla::dom::Element* aDest);