Changeset 74101 in webkit

Timestamp:

Dec 15, 2010 1:47:12 AM (13 years ago)

Author:

commit-queue@webkit.org

Message:

2010-12-15 Emil Eklund <​eae@chromium.org>

Reviewed by Adam Barth.

Added test for infinite loop in ContainerNode::willRemoveChildren.
​https://bugs.webkit.org/show_bug.cgi?id=51079

• fast/dom/containerNode-expected.txt: Added.
• fast/dom/containerNode.html: Added.

2010-12-15 Emil Eklund <​eae@chromium.org>

Reviewed by Adam Barth.

Change ContainerNode::willRemoveChildren to not fire mutation events for children
added as a result of a mutation event, thereby avoiding an infinite loop.
​https://bugs.webkit.org/show_bug.cgi?id=51079

Test: fast/dom/containerNode.html

• dom/ContainerNode.cpp: (WebCore::willRemoveChildren): Don't fire mutation events for children added during a mutation event.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/containerNode-expected.txt (added)
• LayoutTests/fast/dom/containerNode.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/dom/ContainerNode.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-12-15  Emil Eklund  <eae@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Added test for infinite loop in ContainerNode::willRemoveChildren.
+        https://bugs.webkit.org/show_bug.cgi?id=51079
+
+        * fast/dom/containerNode-expected.txt: Added.
+        * fast/dom/containerNode.html: Added.
+
 2010-12-15  Csaba Osztrogonác  <ossy@webkit.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-12-15  Emil Eklund  <eae@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Change ContainerNode::willRemoveChildren to not fire mutation events for children
+        added as a result of a mutation event, thereby avoiding an infinite loop.
+        https://bugs.webkit.org/show_bug.cgi?id=51079
+
+        Test: fast/dom/containerNode.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::willRemoveChildren): Don't fire mutation events for children added during a mutation event.
+
 2010-12-14  Dan Bernstein  <mitz@apple.com>
 

trunk/WebCore/dom/ContainerNode.cpp

@@ -380 +380 @@
     container->document()->incDOMTreeVersion();
 
-    // FIXME: Adding new children from event handlers can cause an infinite loop here.
-    for (RefPtr<Node> child = container->firstChild(); child; child = child->nextSibling()) {
+    NodeVector children;
+    for (Node* n = container->firstChild(); n; n = n->nextSibling())
+        children.append(n);
+
+    for (NodeVector::const_iterator it = children.begin(); it != children.end(); it++) {
+        Node* child = it->get();
         // fire removed from document mutation events.
-        dispatchChildRemovalEvents(child.get());
+        dispatchChildRemovalEvents(child);
         child->willRemove();
     }