Changeset 106715 in webkit

Timestamp:

Feb 3, 2012, 5:22:38 PM (15 years ago)

Author:

rniwa@webkit.org

Message:

Crash in Node::dispatchSubtreeModifiedEvent
​https://bugs.webkit.org/show_bug.cgi?id=77449

Reviewed by Alexey Proskuryakov.

Source/WebCore:

The bug was caused by appendChild not retaining this pointer.
This is normally okay because there's another owner within JSC/V8 binding code that
holds onto the node but this isn't the case when nodes are created as a part
of setting document.title. Fixed the crash by retaining the pointer as needed.

Test: fast/dom/remove-body-during-title-creation.html

• dom/ContainerNode.cpp:

(WebCore::ContainerNode::appendChild):

LayoutTests:

Add a regression test for the crash.

• fast/dom/remove-body-during-title-creation-expected.txt: Added.
• fast/dom/remove-body-during-title-creation.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/remove-body-during-title-creation-expected.txt (added)
• LayoutTests/fast/dom/remove-body-during-title-creation.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/ContainerNode.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-02-03  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in Node::dispatchSubtreeModifiedEvent
+        https://bugs.webkit.org/show_bug.cgi?id=77449
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add a regression test for the crash.
+
+        * fast/dom/remove-body-during-title-creation-expected.txt: Added.
+        * fast/dom/remove-body-during-title-creation.html: Added.
+
 2012-02-03  Joshua Bell  <jsbell@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-02-03  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in Node::dispatchSubtreeModifiedEvent
+        https://bugs.webkit.org/show_bug.cgi?id=77449
+
+        Reviewed by Alexey Proskuryakov.
+
+        The bug was caused by appendChild not retaining this pointer.
+        This is normally okay because there's another owner within JSC/V8 binding code that
+        holds onto the node but this isn't the case when nodes are created as a part
+        of setting document.title. Fixed the crash by retaining the pointer as needed.
+
+        Test: fast/dom/remove-body-during-title-creation.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::appendChild):
+
 2012-02-03  Anders Carlsson  <andersca@apple.com>
 

trunk/Source/WebCore/dom/ContainerNode.cpp

@@ -605 +605 @@
 bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
+    RefPtr<ContainerNode> protector(this);
+
     // Check that this node is not "floating".
     // If it is, it can be deleted as a side effect of sending mutation events.