Changeset 56895 in webkit

Timestamp:

Mar 31, 2010 10:02:43 PM (14 years ago)

Author:

eric@webkit.org

Message:

2010-03-31 MORITA Hajime <​morrita@google.com>

Reviewed by Darin Adler.

Crash when writing into a detached TITLE element
​https://bugs.webkit.org/show_bug.cgi?id=25567

• fast/dom/title-content-write-set-expected.txt: Added.
• fast/dom/title-content-write-set.html: Added.

2010-03-31 MORITA Hajime <​morrita@google.com>

Reviewed by Darin Adler.

Crash when writing into a detached TITLE element
​https://bugs.webkit.org/show_bug.cgi?id=25567

Document::setTitle() invoked HTMLTitleElement::setText(), which
contains DOM tree modification, even when setTitle() is called
from HTMLTitleElement::childrenChanged(). Fix to skip setText()
when setTitle() is called childrenChanged() to avoid cascading
DOM mutations between Document and HTMLTitleElement.

Test: fast/dom/title-content-write-set.html

• dom/Document.cpp: (WebCore::Document::setTitle):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/title-content-write-set-expected.txt (added)
• LayoutTests/fast/dom/title-content-write-set.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/dom/Document.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-03-31  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Darin Adler.
+
+        Crash when writing into a detached TITLE element
+        https://bugs.webkit.org/show_bug.cgi?id=25567
+
+        * fast/dom/title-content-write-set-expected.txt: Added.
+        * fast/dom/title-content-write-set.html: Added.
+
 2010-04-01  Roland Steiner  <rolandsteiner@chromium.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-03-31  MORITA Hajime  <morrita@google.com>
+        
+        Reviewed by Darin Adler.
+
+        Crash when writing into a detached TITLE element
+        https://bugs.webkit.org/show_bug.cgi?id=25567
+        
+        Document::setTitle() invoked HTMLTitleElement::setText(), which
+        contains DOM tree modification, even when setTitle() is called
+        from HTMLTitleElement::childrenChanged().  Fix to skip setText()
+        when setTitle() is called childrenChanged() to avoid cascading
+        DOM mutations between Document and HTMLTitleElement.
+
+        Test: fast/dom/title-content-write-set.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::setTitle):
+
 2010-04-01  Roland Steiner  <rolandsteiner@chromium.org>
 

trunk/WebCore/dom/Document.cpp

@@ -1198 +1198 @@
     updateTitle();
 
-    if (m_titleSetExplicitly && m_titleElement && m_titleElement->hasTagName(titleTag))
+    if (m_titleSetExplicitly && m_titleElement && m_titleElement->hasTagName(titleTag) && !titleElement)
         static_cast<HTMLTitleElement*>(m_titleElement.get())->setText(m_title);
 }