Changeset 109363 in webkit

Timestamp:

Mar 1, 2012, 10:24:14 AM (15 years ago)

Author:

cevans@google.com

Message:

Merge 107749
BUG=111748
Review URL: ​https://chromiumcodereview.appspot.com/9564014

Location:

branches/chromium/963

Files:

• LayoutTests/fast/dom/Range/surround-contents-font-face-crash-expected.txt (copied) (copied from trunk/LayoutTests/fast/dom/Range/surround-contents-font-face-crash-expected.txt )
• LayoutTests/fast/dom/Range/surround-contents-font-face-crash.svg (copied) (copied from trunk/LayoutTests/fast/dom/Range/surround-contents-font-face-crash.svg )
• Source/WebCore/dom/ContainerNodeAlgorithms.h (modified) (1 diff)

branches/chromium/963/Source/WebCore/dom/ContainerNodeAlgorithms.h

@@ -136 +136 @@
 
                 tail = n;
-            } else
+            } else {
+                RefPtr<GenericNode> protect(n); // removedFromDocument may remove remove all references to this node.
                 NodeRemovalDispatcher<GenericNode, ShouldDispatchRemovalNotification<GenericNode>::value>::dispatch(n);
+            }
         }