Changeset 117756 in webkit

Timestamp:

May 21, 2012, 3:47:25 AM (14 years ago)

Author:

kov@webkit.org

Message:

Merge 113887 - StyleElement ownerNode is not cleared correctly
​https://bugs.webkit.org/show_bug.cgi?id=83696

Reviewed by Antti Koivisto.

Source/WebCore:

When the css text changes in such a way that we remove the sheet of a style element or a link[rel=stylesheet]
element we need to ensure that the ownerNode of the sheet is cleared. If we don't do this and there is a
wrapper for the sheet the sheet is kept alive but the ownerNode of the sheet may point to a deleted node.

Tests: fast/dom/StyleSheet/detached-sheet-owner-node-link.html

fast/dom/StyleSheet/detached-sheet-owner-node.html

• dom/StyleElement.cpp:

(WebCore::StyleElement::removedFromDocument):
(WebCore::StyleElement::clearSheet):
(WebCore):
(WebCore::StyleElement::createSheet):

• dom/StyleElement.h:

(StyleElement):

• html/HTMLLinkElement.cpp:

(WebCore::HTMLLinkElement::process):
(WebCore::HTMLLinkElement::clearSheet):
(WebCore):

• html/HTMLLinkElement.h:

(HTMLLinkElement):

LayoutTests:

• fast/dom/StyleSheet/detached-sheet-owner-node-expected.txt: Added.
• fast/dom/StyleSheet/detached-sheet-owner-node-link-expected.txt: Added.
• fast/dom/StyleSheet/detached-sheet-owner-node-link.html: Added.
• fast/dom/StyleSheet/detached-sheet-owner-node.html: Added.

Location:

releases/WebKitGTK/webkit-1.8

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node-expected.txt (added)
• LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node-link-expected.txt (added)
• LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node-link.html (added)
• LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/StyleElement.cpp (modified) (3 diffs)
• Source/WebCore/dom/StyleElement.h (modified) (1 diff)
• Source/WebCore/html/HTMLLinkElement.cpp (modified) (2 diffs)
• Source/WebCore/html/HTMLLinkElement.h (modified) (1 diff)

releases/WebKitGTK/webkit-1.8/LayoutTests/ChangeLog

@@ +1 @@
+2012-04-11  Erik Arvidsson  <arv@chromium.org>
+
+        StyleElement ownerNode is not cleared correctly
+        https://bugs.webkit.org/show_bug.cgi?id=83696
+
+        Reviewed by Antti Koivisto.
+
+        * fast/dom/StyleSheet/detached-sheet-owner-node-expected.txt: Added.
+        * fast/dom/StyleSheet/detached-sheet-owner-node-link-expected.txt: Added.
+        * fast/dom/StyleSheet/detached-sheet-owner-node-link.html: Added.
+        * fast/dom/StyleSheet/detached-sheet-owner-node.html: Added.
+
 2012-04-03  Abhishek Arya  <inferno@chromium.org>
 

releases/WebKitGTK/webkit-1.8/Source/WebCore/ChangeLog

@@ +1 @@
+2012-04-11  Erik Arvidsson  <arv@chromium.org>
+
+        StyleElement ownerNode is not cleared correctly
+        https://bugs.webkit.org/show_bug.cgi?id=83696
+
+        Reviewed by Antti Koivisto.
+
+        When the css text changes in such a way that we remove the sheet of a style element or a link[rel=stylesheet]
+        element we need to ensure that the ownerNode of the sheet is cleared. If we don't do this and there is a
+        wrapper for the sheet the sheet is kept alive but the ownerNode of the sheet may point to a deleted node.
+
+        Tests: fast/dom/StyleSheet/detached-sheet-owner-node-link.html
+               fast/dom/StyleSheet/detached-sheet-owner-node.html
+
+        * dom/StyleElement.cpp:
+        (WebCore::StyleElement::removedFromDocument):
+        (WebCore::StyleElement::clearSheet):
+        (WebCore):
+        (WebCore::StyleElement::createSheet):
+        * dom/StyleElement.h:
+        (StyleElement):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+        (WebCore::HTMLLinkElement::clearSheet):
+        (WebCore):
+        * html/HTMLLinkElement.h:
+        (HTMLLinkElement):
+
 2012-04-03  Abhishek Arya  <inferno@chromium.org>
 

releases/WebKitGTK/webkit-1.8/Source/WebCore/dom/StyleElement.cpp

@@ -75 +75 @@
     document->removeStyleSheetCandidateNode(element);
 
-    if (m_sheet) {
-        ASSERT(m_sheet->ownerNode() == element);
-        m_sheet->clearOwnerNode();
-        m_sheet = 0;
-    }
+    if (m_sheet)
+        clearSheet();
 
     // If we're in document teardown, then we don't need to do any notification of our sheet's removal.
@@ -140 +137 @@
 }
 
+void StyleElement::clearSheet()
+{
+    ASSERT(m_sheet);
+    m_sheet->clearOwnerNode();
+    m_sheet = 0;
+}
+
 void StyleElement::createSheet(Element* e, int startLineNumber, const String& text)
 {
@@ -148 +152 @@
         if (m_sheet->isLoading())
             document->removePendingSheet();
-        m_sheet = 0;
+        clearSheet();
     }
 

releases/WebKitGTK/webkit-1.8/Source/WebCore/dom/StyleElement.h

@@ -55 +55 @@
     void createSheet(Element*, int startLineNumber, const String& text = String());
     void process(Element*);
+    void clearSheet();
 
     bool m_createdByParser;

releases/WebKitGTK/webkit-1.8/Source/WebCore/html/HTMLLinkElement.cpp

@@ -224 +224 @@
     } else if (m_sheet) {
         // we no longer contain a stylesheet, e.g. perhaps rel or type was changed
-        m_sheet = 0;
+        clearSheet();
         document()->styleSelectorChanged(DeferRecalcStyle);
     }
+}
+
+void HTMLLinkElement::clearSheet()
+{
+    ASSERT(m_sheet);
+    ASSERT(m_sheet->ownerNode() == this);
+    m_sheet->clearOwnerNode();
+    m_sheet = 0;
 }
 
@@ -252 +260 @@
     document()->removeStyleSheetCandidateNode(this);
 
-    if (m_sheet) {
-        ASSERT(m_sheet->ownerNode() == this);
-        m_sheet->clearOwnerNode();
-        m_sheet = 0;
-    }
+    if (m_sheet)
+        clearSheet();
 
     if (document()->renderer())

releases/WebKitGTK/webkit-1.8/Source/WebCore/html/HTMLLinkElement.h

@@ -67 +67 @@
     void process();
     static void processCallback(Node*);
+    void clearSheet();
 
     virtual void insertedIntoDocument();