Changeset 91895 in webkit

Timestamp:

Jul 27, 2011, 8:44:57 PM (14 years ago)

Author:

morrita@google.com

Message:

Source/WebCore: Inconsistent state of TreeScope reference.
​https://bugs.webkit.org/show_bug.cgi?id=65235

The tree scope pointers on shadow tree nodes didn't cleared.
even when the tree scope (shadow root) is destroyed.
This change clear these poitners before detaching the shadow root.

Reviewed by Dimitri Glazkov.

Test: fast/dom/shadow/tree-scope-crash.html

• dom/Element.cpp:

(WebCore::Element::removeShadowRoot):

LayoutTests: Inconsistent state of TreeScope reference.
​https://bugs.webkit.org/show_bug.cgi?id=65235

Reviewed by Dimitri Glazkov.

• fast/dom/shadow/tree-scope-crash-expected.txt: Added.
• fast/dom/shadow/tree-scope-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/shadow/tree-scope-crash-expected.txt (added)
• LayoutTests/fast/dom/shadow/tree-scope-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Element.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-07-27  MORITA Hajime  <morrita@google.com>
+
+        Inconsistent state of TreeScope reference.
+        https://bugs.webkit.org/show_bug.cgi?id=65235
+
+        Reviewed by Dimitri Glazkov.
+
+        * fast/dom/shadow/tree-scope-crash-expected.txt: Added.
+        * fast/dom/shadow/tree-scope-crash.html: Added.
+
 2011-07-27  Rachel Blum  <groby@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-07-27  MORITA Hajime  <morrita@google.com>
+
+        Inconsistent state of TreeScope reference.
+        https://bugs.webkit.org/show_bug.cgi?id=65235
+        
+        The tree scope pointers on shadow tree nodes didn't cleared.
+        even when the tree scope (shadow root) is destroyed.
+        This change clear these poitners before detaching the shadow root.
+
+        Reviewed by Dimitri Glazkov.
+
+        Test: fast/dom/shadow/tree-scope-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::removeShadowRoot):
+
 2011-07-27  Rachel Blum  <groby@chromium.org>
 

trunk/Source/WebCore/dom/Element.cpp

@@ -1261 +1261 @@
 
         oldRoot->setShadowHost(0);
-
+        oldRoot->setTreeScopeRecursively(document());
         if (oldRoot->inDocument())
             oldRoot->removedFromDocument();