Changeset 107339 in webkit

Timestamp:

Feb 9, 2012, 6:32:54 PM (15 years ago)

Author:

cevans@google.com

Message:

Merge 106715
BUG=112093
Review URL: ​https://chromiumcodereview.appspot.com/9374043

Location:

branches/chromium/963

Files:

• LayoutTests/fast/dom/remove-body-during-title-creation-expected.txt (copied) (copied from trunk/LayoutTests/fast/dom/remove-body-during-title-creation-expected.txt )
• LayoutTests/fast/dom/remove-body-during-title-creation.html (copied) (copied from trunk/LayoutTests/fast/dom/remove-body-during-title-creation.html )
• Source/WebCore/dom/ContainerNode.cpp (modified) (1 diff)

branches/chromium/963/Source/WebCore/dom/ContainerNode.cpp

@@ -606 +606 @@
 bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
+    RefPtr<ContainerNode> protector(this);
+
     // Check that this node is not "floating".
     // If it is, it can be deleted as a side effect of sending mutation events.