Node::attach() should be after attaching children in Element::attach().

https://bugs.webkit.org/show_bug.cgi?id=79201

Reviewed by Hajime Morita.

In Element::attach(), Node::attach() is called before attaching children if a shaodw root exists.
This may cause O(N^2) problem in NodeRenderingContext.

No new tests. Existing tests should cover this.

* dom/Element.cpp:
(WebCore::Element::attach):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@108470 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 7d10fbb..f9fe5a6 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2012-02-22  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Node::attach() should be after attaching children in Element::attach().
+        https://bugs.webkit.org/show_bug.cgi?id=79201
+
+        Reviewed by Hajime Morita.
+
+        In Element::attach(), Node::attach() is called before attaching children if a shaodw root exists.
+        This may cause O(N^2) problem in NodeRenderingContext.
+
+        No new tests. Existing tests should cover this.
+
+        * dom/Element.cpp:
+        (WebCore::Element::attach):
+
 2012-02-22  Kenichi Ishibashi  <bashi@chromium.org>
 
         Adding WebSocket per-frame DEFLATE extension

diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index a7c417f..9f26195 100644 (file)
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -928,7 +928,6 @@ void Element::attach()
     // When a shadow root exists, it does the work of attaching the children.
     if (hasShadowRoot()) {
         parentPusher.push();
-        Node::attach();
         shadowRootList()->attach();
 
         // In a shadow tree, some of light children may be attached by 'content' element.
@@ -938,6 +937,7 @@ void Element::attach()
             if (!child->attached())
                 child->attach();
         }
+        Node::attach();
     } else {
         if (firstChild())
             parentPusher.push();