Changeset 55783 in webkit

Timestamp:

Mar 10, 2010, 8:56:35 AM (17 years ago)

Author:

Dimitri Glazkov

Message:

Add one more parent check during node removal.
​https://bugs.webkit.org/show_bug.cgi?id=35818

Reviewed by Sam Weinig.

WebCore:

Test: fast/dom/Node/mutation-blur.html

• dom/ContainerNode.cpp:

(WebCore::ContainerNode::removeChild): Added check.

LayoutTests:

• fast/dom/Node/mutation-blur-expected.txt: Added.
• fast/dom/Node/mutation-blur.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/Node/mutation-blur-expected.txt (added)
• LayoutTests/fast/dom/Node/mutation-blur.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/dom/ContainerNode.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Add one more parent check during node removal.
+        https://bugs.webkit.org/show_bug.cgi?id=35818
+
+        * fast/dom/Node/mutation-blur-expected.txt: Added.
+        * fast/dom/Node/mutation-blur.html: Added.
+
 2010-03-10  Csaba Osztrogonác  <ossy@webkit.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Add one more parent check during node removal.
+        https://bugs.webkit.org/show_bug.cgi?id=35818
+
+        Test: fast/dom/Node/mutation-blur.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChild): Added check.
+
 2010-03-10  Pavel Feldman  <pfeldman@chromium.org>
 

trunk/WebCore/dom/ContainerNode.cpp

@@ -342 +342 @@
     document()->removeFocusedNodeOfSubtree(child.get());
     
+    // Events fired when blurring currently focused node might have moved this
+    // child into a different parent.
+    if (child->parentNode() != this) {
+        ec = NOT_FOUND_ERR;
+        return false;
+    }
+
     // FIXME: After sending the mutation events, "this" could be destroyed.
     // We can prevent that by doing a "ref", but first we have to make sure