Changeset 45180 in webkit

Timestamp:

Jun 25, 2009, 12:45:30 PM (16 years ago)

Author:

mitz@apple.com

Message:

WebCore:

Reviewed by Darin Adler.

• fix ​https://bugs.webkit.org/show_bug.cgi?id=26671 <rdar://problem/7001880> Safari 4.0 crashes in WebCore::DOMTimer::fired()

Test: fast/dom/style-sheet-candidate-remove-unrendered-document.html

When a "style sheet candidate" element is removed from a document,
call Document::removeStyleSheetCandidateNode() regardless of whether
the document is rendered. Otherwise, the document's style sheet
candidate set can end up containing stale references.

• dom/ProcessingInstruction.cpp: (WebCore::ProcessingInstruction::removedFromDocument):
• html/HTMLLinkElement.cpp: (WebCore::HTMLLinkElement::removedFromDocument):
• html/HTMLStyleElement.cpp: (WebCore::HTMLStyleElement::removedFromDocument):

LayoutTests:

Reviewed by Darin Adler.

• test for ​https://bugs.webkit.org/show_bug.cgi?id=26671 <rdar://problem/7001880> Safari 4.0 crashes in WebCore::DOMTimer::fired()

• fast/dom/style-sheet-candidate-remove-unrendered-document-expected.txt: Added.
• fast/dom/style-sheet-candidate-remove-unrendered-document.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/style-sheet-candidate-remove-unrendered-document-expected.txt (added)
• LayoutTests/fast/dom/style-sheet-candidate-remove-unrendered-document.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/dom/ProcessingInstruction.cpp (modified) (1 diff)
• WebCore/html/HTMLLinkElement.cpp (modified) (1 diff)
• WebCore/html/HTMLStyleElement.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-06-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - test for https://bugs.webkit.org/show_bug.cgi?id=26671
+          <rdar://problem/7001880> Safari 4.0 crashes in
+          WebCore::DOMTimer::fired()
+
+        * fast/dom/style-sheet-candidate-remove-unrendered-document-expected.txt: Added.
+        * fast/dom/style-sheet-candidate-remove-unrendered-document.html: Added.
+
 2009-06-25  Eric Seidel  <eric@webkit.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-06-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26671
+          <rdar://problem/7001880> Safari 4.0 crashes in
+          WebCore::DOMTimer::fired()
+
+        Test: fast/dom/style-sheet-candidate-remove-unrendered-document.html
+
+        When a "style sheet candidate" element is removed from a document,
+        call Document::removeStyleSheetCandidateNode() regardless of whether
+        the document is rendered. Otherwise, the document's style sheet
+        candidate set can end up containing stale references.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::removedFromDocument):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::removedFromDocument):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::removedFromDocument):
+
 2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
 

trunk/WebCore/dom/ProcessingInstruction.cpp

@@ -259 +259 @@
     ContainerNode::removedFromDocument();
 
-    if (document()->renderer())
-        document()->removeStyleSheetCandidateNode(this);
+    document()->removeStyleSheetCandidateNode(this);
 
     // FIXME: It's terrible to do a synchronous update of the style selector just because a <style> or <link> element got removed.

trunk/WebCore/html/HTMLLinkElement.cpp

@@ -226 +226 @@
     HTMLElement::removedFromDocument();
 
+    document()->removeStyleSheetCandidateNode(this);
+
     // FIXME: It's terrible to do a synchronous update of the style selector just because a <style> or <link> element got removed.
-    if (document()->renderer()) {
-        document()->removeStyleSheetCandidateNode(this);
+    if (document()->renderer())
         document()->updateStyleSelector();
-    }
 }
 

trunk/WebCore/html/HTMLStyleElement.cpp

@@ -72 +72 @@
 {
     HTMLElement::removedFromDocument();
-    if (document()->renderer())
-        document()->removeStyleSheetCandidateNode(this);
+    document()->removeStyleSheetCandidateNode(this);
     StyleElement::removedFromDocument(document());
 }