Title: [107342] branches/chromium/1025
- Revision
- 107342
- Author
- [email protected]
- Date
- 2012-02-09 18:45:14 -0800 (Thu, 09 Feb 2012)
Log Message
Merge 106715
BUG=112093
Review URL: https://chromiumcodereview.appspot.com/9374044
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-title-creation-expected.txt (from rev 106715, trunk/LayoutTests/fast/dom/remove-body-during-title-creation-expected.txt) (0 => 107342)
--- branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-title-creation-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-title-creation-expected.txt 2012-02-10 02:45:14 UTC (rev 107342)
@@ -0,0 +1 @@
+PASS. WebKit didn't crash.
Copied: branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-title-creation.html (from rev 106715, trunk/LayoutTests/fast/dom/remove-body-during-title-creation.html) (0 => 107342)
--- branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-title-creation.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-title-creation.html 2012-02-10 02:45:14 UTC (rev 107342)
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<body><div><script>
+
+if (!window.layoutTestController)
+ document.write("This test requires GCController.");
+else {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+
+ function crash() {
+ if (document.lastChild.firstChild.firstChild.firstChild) {
+ document.lastChild.removeChild(document.lastChild.firstChild);
+ GCController.collect();
+ setTimeout(function () {
+ document.body.innerHTML = "PASS. WebKit didn't crash."
+ layoutTestController.notifyDone();
+ }, 0);
+ }
+ GCController.collect();
+ }
+
+ setTimeout(function () {
+ document.addEventListener('DOMNodeInsertedIntoDocument', function () { crash(); }, true);
+ document.addEventListener('DOMSubtreeModified', function () { /* noop */ }, false);
+ document.title = 'hello';
+ }, 0);
+}
+
+</script>
+</body>
+</html>
Modified: branches/chromium/1025/Source/WebCore/dom/ContainerNode.cpp (107341 => 107342)
--- branches/chromium/1025/Source/WebCore/dom/ContainerNode.cpp 2012-02-10 02:35:15 UTC (rev 107341)
+++ branches/chromium/1025/Source/WebCore/dom/ContainerNode.cpp 2012-02-10 02:45:14 UTC (rev 107342)
@@ -605,6 +605,8 @@
bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
{
+ RefPtr<ContainerNode> protector(this);
+
// Check that this node is not "floating".
// If it is, it can be deleted as a side effect of sending mutation events.
ASSERT(refCount() || parentOrHostNode());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
