Title: [106715] trunk
- Revision
- 106715
- Author
- [email protected]
- Date
- 2012-02-03 17:22:38 -0800 (Fri, 03 Feb 2012)
Log Message
Crash in Node::dispatchSubtreeModifiedEvent
https://bugs.webkit.org/show_bug.cgi?id=77449
Reviewed by Alexey Proskuryakov.
Source/WebCore:
The bug was caused by appendChild not retaining this pointer.
This is normally okay because there's another owner within JSC/V8 binding code that
holds onto the node but this isn't the case when nodes are created as a part
of setting document.title. Fixed the crash by retaining the pointer as needed.
Test: fast/dom/remove-body-during-title-creation.html
* dom/ContainerNode.cpp:
(WebCore::ContainerNode::appendChild):
LayoutTests:
Add a regression test for the crash.
* fast/dom/remove-body-during-title-creation-expected.txt: Added.
* fast/dom/remove-body-during-title-creation.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (106714 => 106715)
--- trunk/LayoutTests/ChangeLog 2012-02-04 01:19:05 UTC (rev 106714)
+++ trunk/LayoutTests/ChangeLog 2012-02-04 01:22:38 UTC (rev 106715)
@@ -1,3 +1,15 @@
+2012-02-03 Ryosuke Niwa <[email protected]>
+
+ Crash in Node::dispatchSubtreeModifiedEvent
+ https://bugs.webkit.org/show_bug.cgi?id=77449
+
+ Reviewed by Alexey Proskuryakov.
+
+ Add a regression test for the crash.
+
+ * fast/dom/remove-body-during-title-creation-expected.txt: Added.
+ * fast/dom/remove-body-during-title-creation.html: Added.
+
2012-02-03 Joshua Bell <[email protected]>
IndexedDB: Key generators not rolled back if insertion fails or is aborted
Added: trunk/LayoutTests/fast/dom/remove-body-during-title-creation-expected.txt (0 => 106715)
--- trunk/LayoutTests/fast/dom/remove-body-during-title-creation-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/remove-body-during-title-creation-expected.txt 2012-02-04 01:22:38 UTC (rev 106715)
@@ -0,0 +1 @@
+PASS. WebKit didn't crash.
Added: trunk/LayoutTests/fast/dom/remove-body-during-title-creation.html (0 => 106715)
--- trunk/LayoutTests/fast/dom/remove-body-during-title-creation.html (rev 0)
+++ trunk/LayoutTests/fast/dom/remove-body-during-title-creation.html 2012-02-04 01:22:38 UTC (rev 106715)
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<body><div><script>
+
+if (!window.layoutTestController)
+ document.write("This test requires GCController.");
+else {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+
+ function crash() {
+ if (document.lastChild.firstChild.firstChild.firstChild) {
+ document.lastChild.removeChild(document.lastChild.firstChild);
+ GCController.collect();
+ setTimeout(function () {
+ document.body.innerHTML = "PASS. WebKit didn't crash."
+ layoutTestController.notifyDone();
+ }, 0);
+ }
+ GCController.collect();
+ }
+
+ setTimeout(function () {
+ document.addEventListener('DOMNodeInsertedIntoDocument', function () { crash(); }, true);
+ document.addEventListener('DOMSubtreeModified', function () { /* noop */ }, false);
+ document.title = 'hello';
+ }, 0);
+}
+
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (106714 => 106715)
--- trunk/Source/WebCore/ChangeLog 2012-02-04 01:19:05 UTC (rev 106714)
+++ trunk/Source/WebCore/ChangeLog 2012-02-04 01:22:38 UTC (rev 106715)
@@ -1,3 +1,20 @@
+2012-02-03 Ryosuke Niwa <[email protected]>
+
+ Crash in Node::dispatchSubtreeModifiedEvent
+ https://bugs.webkit.org/show_bug.cgi?id=77449
+
+ Reviewed by Alexey Proskuryakov.
+
+ The bug was caused by appendChild not retaining this pointer.
+ This is normally okay because there's another owner within JSC/V8 binding code that
+ holds onto the node but this isn't the case when nodes are created as a part
+ of setting document.title. Fixed the crash by retaining the pointer as needed.
+
+ Test: fast/dom/remove-body-during-title-creation.html
+
+ * dom/ContainerNode.cpp:
+ (WebCore::ContainerNode::appendChild):
+
2012-02-03 Anders Carlsson <[email protected]>
Apply changed properties from the updated scrolling tree state
Modified: trunk/Source/WebCore/dom/ContainerNode.cpp (106714 => 106715)
--- trunk/Source/WebCore/dom/ContainerNode.cpp 2012-02-04 01:19:05 UTC (rev 106714)
+++ trunk/Source/WebCore/dom/ContainerNode.cpp 2012-02-04 01:22:38 UTC (rev 106715)
@@ -604,6 +604,8 @@
bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
{
+ RefPtr<ContainerNode> protector(this);
+
// Check that this node is not "floating".
// If it is, it can be deleted as a side effect of sending mutation events.
ASSERT(refCount() || parentOrHostNode());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
