Diff
Modified: branches/safari-534.51-branch/LayoutTests/ChangeLog (91500 => 91501)
--- branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-07-21 21:34:36 UTC (rev 91500)
+++ branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-07-21 21:37:16 UTC (rev 91501)
@@ -1,3 +1,22 @@
+2011-07-21 Lucas Forschler <[email protected]>
+
+ Merged 88987.
+
+ 2011-06-15 Abhishek Arya <[email protected]>
+
+ Reviewed by Antti Koivisto.
+
+ Tests that accessing the parent stylesheet in nodes (not in document)
+ do not result in crash when document is cleared.
+ https://bugs.webkit.org/show_bug.cgi?id=62586
+
+ * fast/dom/body-clone-link-decl-parent-crash-expected.txt: Added.
+ * fast/dom/body-clone-link-decl-parent-crash.html: Added.
+ * fast/dom/styled-clone-inline-style-decl-parent-crash-expected.txt: Added.
+ * fast/dom/styled-clone-inline-style-decl-parent-crash.html: Added.
+ * fast/dom/styled-not-in-document-clone-inline-style-decl-parent-crash-expected.txt: Added.
+ * fast/dom/styled-not-in-document-clone-inline-style-decl-parent-crash.html: Added.
+
2011-07-20 Lucas Forschler <[email protected]>
Merged 88601.
Copied: branches/safari-534.51-branch/LayoutTests/fast/dom/body-clone-link-decl-parent-crash-expected.txt (from rev 88987, trunk/LayoutTests/fast/dom/body-clone-link-decl-parent-crash-expected.txt) (0 => 91501)
--- branches/safari-534.51-branch/LayoutTests/fast/dom/body-clone-link-decl-parent-crash-expected.txt (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/fast/dom/body-clone-link-decl-parent-crash-expected.txt 2011-07-21 21:37:16 UTC (rev 91501)
@@ -0,0 +1,5 @@
+Test passes if it does not crash.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/safari-534.51-branch/LayoutTests/fast/dom/body-clone-link-decl-parent-crash.html (from rev 88987, trunk/LayoutTests/fast/dom/body-clone-link-decl-parent-crash.html) (0 => 91501)
--- branches/safari-534.51-branch/LayoutTests/fast/dom/body-clone-link-decl-parent-crash.html (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/fast/dom/body-clone-link-decl-parent-crash.html 2011-07-21 21:37:16 UTC (rev 91501)
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+Test passes if it does not crash.
+<div id="console"></div>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+iframe1 = document.createElement('iframe');
+document.body.appendChild(iframe1);
+document1 = iframe1.contentDocument.implementation.createHTMLDocument("document");
+var body1 = document1.body;
+document1.alinkColor = "blue";
+var body2 = body1.cloneNode(true);
+document1.body = document1.createElement('body');
+delete document1;
+gc();
+body2.vLink = 1;
+
+var successfullyParsed = true;
+</script>
+<script src=""
+</body>
+</html>
Copied: branches/safari-534.51-branch/LayoutTests/fast/dom/styled-clone-inline-style-decl-parent-crash-expected.txt (from rev 88987, trunk/LayoutTests/fast/dom/styled-clone-inline-style-decl-parent-crash-expected.txt) (0 => 91501)
--- branches/safari-534.51-branch/LayoutTests/fast/dom/styled-clone-inline-style-decl-parent-crash-expected.txt (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/fast/dom/styled-clone-inline-style-decl-parent-crash-expected.txt 2011-07-21 21:37:16 UTC (rev 91501)
@@ -0,0 +1,5 @@
+Test passes if it does not crash.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/safari-534.51-branch/LayoutTests/fast/dom/styled-clone-inline-style-decl-parent-crash.html (from rev 88987, trunk/LayoutTests/fast/dom/styled-clone-inline-style-decl-parent-crash.html) (0 => 91501)
--- branches/safari-534.51-branch/LayoutTests/fast/dom/styled-clone-inline-style-decl-parent-crash.html (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/fast/dom/styled-clone-inline-style-decl-parent-crash.html 2011-07-21 21:37:16 UTC (rev 91501)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+Test passes if it does not crash.
+<div id="console"></div>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+iframe1 = document.createElement('iframe');
+document.body.appendChild(iframe1);
+document1 = iframe1.contentDocument.implementation.createHTMLDocument("document");
+var div1 = document1.createElement('div');
+document1.body.appendChild(div1);
+div1.style.color = "blue";
+var div2 = div1.cloneNode(true);
+document1.body.removeChild(div1);
+delete document1;
+gc();
+div2.style.color = "red";
+
+var successfullyParsed = true;
+</script>
+<script src=""
+</body>
+</html>
Copied: branches/safari-534.51-branch/LayoutTests/fast/dom/styled-not-in-document-clone-inline-style-decl-parent-crash-expected.txt (from rev 88987, trunk/LayoutTests/fast/dom/styled-not-in-document-clone-inline-style-decl-parent-crash-expected.txt) (0 => 91501)
--- branches/safari-534.51-branch/LayoutTests/fast/dom/styled-not-in-document-clone-inline-style-decl-parent-crash-expected.txt (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/fast/dom/styled-not-in-document-clone-inline-style-decl-parent-crash-expected.txt 2011-07-21 21:37:16 UTC (rev 91501)
@@ -0,0 +1,5 @@
+Test passes if it does not crash.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/safari-534.51-branch/LayoutTests/fast/dom/styled-not-in-document-clone-inline-style-decl-parent-crash.html (from rev 88987, trunk/LayoutTests/fast/dom/styled-not-in-document-clone-inline-style-decl-parent-crash.html) (0 => 91501)
--- branches/safari-534.51-branch/LayoutTests/fast/dom/styled-not-in-document-clone-inline-style-decl-parent-crash.html (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/fast/dom/styled-not-in-document-clone-inline-style-decl-parent-crash.html 2011-07-21 21:37:16 UTC (rev 91501)
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+Test passes if it does not crash.
+<div id="console"></div>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+iframe1 = document.createElement('iframe');
+document.body.appendChild(iframe1);
+document1 = iframe1.contentDocument.implementation.createHTMLDocument("document");
+var div1 = document1.createElement('div');
+div1.style.color = "blue";
+var div2 = div1.cloneNode(true);
+delete document1;
+gc();
+div2.style.color = "red";
+
+var successfullyParsed = true;
+</script>
+<script src=""
+</body>
+</html>
Modified: branches/safari-534.51-branch/Source/WebCore/ChangeLog (91500 => 91501)
--- branches/safari-534.51-branch/Source/WebCore/ChangeLog 2011-07-21 21:34:36 UTC (rev 91500)
+++ branches/safari-534.51-branch/Source/WebCore/ChangeLog 2011-07-21 21:37:16 UTC (rev 91501)
@@ -1,5 +1,24 @@
2011-07-21 Lucas Forschler <[email protected]>
+ Merged 88987.
+
+ 2011-06-15 Abhishek Arya <[email protected]>
+
+ Reviewed by Antti Koivisto.
+
+ Revert speculative fix in r84151. It caused some issues with
+ stylesheet lifetimes.
+ https://bugs.webkit.org/show_bug.cgi?id=62586
+
+ Tests: fast/dom/body-clone-link-decl-parent-crash.html
+ fast/dom/styled-clone-inline-style-decl-parent-crash.html
+ fast/dom/styled-not-in-document-clone-inline-style-decl-parent-crash.html
+
+ * dom/Document.cpp:
+ (WebCore::Document::removedLastRef):
+
+2011-07-21 Lucas Forschler <[email protected]>
+
Merged 88601.
2011-06-10 Abhishek Arya <[email protected]>
Modified: branches/safari-534.51-branch/Source/WebCore/dom/Document.cpp (91500 => 91501)
--- branches/safari-534.51-branch/Source/WebCore/dom/Document.cpp 2011-07-21 21:34:36 UTC (rev 91500)
+++ branches/safari-534.51-branch/Source/WebCore/dom/Document.cpp 2011-07-21 21:37:16 UTC (rev 91501)
@@ -571,12 +571,6 @@
#if ENABLE(FULLSCREEN_API)
m_fullScreenElement = 0;
#endif
- m_styleSelector.clear();
- m_styleSheets.clear();
- m_elemSheet.clear();
- m_mappedElementSheet.clear();
- m_pageUserSheet.clear();
- m_pageGroupUserSheets.clear();
// removeAllChildren() doesn't always unregister IDs,
// so tear down scope information upfront to avoid having stale references in the map.
