projects / profile / ivi / webkit-efl.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 6eba99e)
Crash in Document::nodeChildrenWillBeRemoved.
authorinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 16 May 2012 06:45:05 +0000 (06:45 +0000)
committerinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 16 May 2012 06:45:05 +0000 (06:45 +0000)
https://bugs.webkit.org/show_bug.cgi?id=85247

Reviewed by Hajime Morita.

Source/WebCore:

Reverse ordering of commands to ref ptr the children set
first before calling nodeChildrenWillBeRemoved, since it
can fire mutation events.

Test: fast/dom/HTMLObjectElement/beforeload-set-text-crash.xhtml

* dom/ContainerNode.cpp:
(WebCore::willRemoveChildren):

LayoutTests:

* fast/dom/HTMLObjectElement/beforeload-set-text-crash-expected.txt: Added.
* fast/dom/HTMLObjectElement/beforeload-set-text-crash.xhtml: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@117224 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/dom/HTMLObjectElement/beforeload-set-text-crash-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/dom/HTMLObjectElement/beforeload-set-text-crash.xhtml [new file with mode: 0755] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/dom/ContainerNode.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 7ec24db..08f91c9 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2012-05-15  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in Document::nodeChildrenWillBeRemoved.
+        https://bugs.webkit.org/show_bug.cgi?id=85247
+
+        Reviewed by Hajime Morita.
+
+        * fast/dom/HTMLObjectElement/beforeload-set-text-crash-expected.txt: Added.
+        * fast/dom/HTMLObjectElement/beforeload-set-text-crash.xhtml: Added.
+
 2012-05-15  Li Yin  <li.yin@intel.com>
 
         [Worker] Web Worker lacks test for posting structured data message.
diff --git a/LayoutTests/fast/dom/HTMLObjectElement/beforeload-set-text-crash-expected.txt b/LayoutTests/fast/dom/HTMLObjectElement/beforeload-set-text-crash-expected.txt
new file mode 100644 (file)
index 0000000..4833705
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLObjectElement/beforeload-set-text-crash-expected.txt
@@ -0,0 +1,4 @@
+PASS successfullyParsed is true
+
+TEST COMPLETE
+Test passes if it does not crash. 
diff --git a/LayoutTests/fast/dom/HTMLObjectElement/beforeload-set-text-crash.xhtml b/LayoutTests/fast/dom/HTMLObjectElement/beforeload-set-text-crash.xhtml
new file mode 100755 (executable)
index 0000000..7f4d68d
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLObjectElement/beforeload-set-text-crash.xhtml
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+Test passes if it does not crash.
+<object id="object" type="image/svg+xml" />
+<script src="../../js/resources/js-test-pre.js"></script>
+<script>
+window.jsTestIsAsync = true;
+var count = 0;
+function setText() {
+    count++;
+    if (count > 100) {
+        document.removeEventListener("beforeload", setText, true);
+        finishJSTest();
+    }
+    gc(); // Because we are recursively entering into setText, can't gc() after this command.
+    document.getElementById("object").textContent = "A";
+}
+document.execCommand("SelectAll");
+document.getElementById("object").textContent = "A";
+document.addEventListener("beforeload", setText, true);
+event = document.createEvent("Event");
+event.initEvent("beforeload", false);
+document.documentElement.dispatchEvent(event);
+</script>
+<script src="../../js/resources/js-test-post.js"></script>
+</html>
+
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 2645cef..e64f9ef 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2012-05-15  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in Document::nodeChildrenWillBeRemoved.
+        https://bugs.webkit.org/show_bug.cgi?id=85247
+
+        Reviewed by Hajime Morita.
+
+        Reverse ordering of commands to ref ptr the children set
+        first before calling nodeChildrenWillBeRemoved, since it
+        can fire mutation events.
+
+        Test: fast/dom/HTMLObjectElement/beforeload-set-text-crash.xhtml
+
+        * dom/ContainerNode.cpp:
+        (WebCore::willRemoveChildren):
+
 2012-05-15  Igor Oliveira  <igor.o@sisa.samsung.com>
 
         regression(111639): Issue with simultaneous CSS animations
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index 3c0e66c..33ad817 100644 (file)
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -322,11 +322,11 @@ static void willRemoveChild(Node* child)
 
 static void willRemoveChildren(ContainerNode* container)
 {
-    container->document()->nodeChildrenWillBeRemoved(container);
-
     NodeVector children;
     getChildNodes(container, children);
 
+    container->document()->nodeChildrenWillBeRemoved(container);
+
 #if ENABLE(MUTATION_OBSERVERS)
     ChildListMutationScope mutation(container);
 #endif
Domain: Web Framework / Uncategorized;