Diff
Copied: branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-body-replacement-expected.txt (from rev 106972, trunk/LayoutTests/fast/dom/remove-body-during-body-replacement-expected.txt) (0 => 107343)
--- branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-body-replacement-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-body-replacement-expected.txt 2012-02-10 02:47:04 UTC (rev 107343)
@@ -0,0 +1 @@
+PASS. WebKit didn't crash.
Copied: branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-body-replacement.html (from rev 106972, trunk/LayoutTests/fast/dom/remove-body-during-body-replacement.html) (0 => 107343)
--- branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-body-replacement.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-body-replacement.html 2012-02-10 02:47:04 UTC (rev 107343)
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<body><div><script>
+
+if (!window.layoutTestController)
+ document.write("This test requires GCController.");
+else {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+
+ function crash() {
+ document.open();
+ document.write("PASS. WebKit didn't crash.");
+ document.close();
+ GCController.collect();
+ setTimeout("layoutTestController.notifyDone()", 0);
+ }
+
+ setTimeout(function () {
+ document.addEventListener('DOMNodeInsertedIntoDocument', function () { crash(); }, true);
+ document.addEventListener('DOMSubtreeModified', function () { /* noop */ }, false);
+ document.body = document.createElement('body');
+ }, 0);
+}
+
+</script>
+</body>
+</html>
Copied: branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-body-replacement2-expected.txt (from rev 106972, trunk/LayoutTests/fast/dom/remove-body-during-body-replacement2-expected.txt) (0 => 107343)
--- branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-body-replacement2-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-body-replacement2-expected.txt 2012-02-10 02:47:04 UTC (rev 107343)
@@ -0,0 +1 @@
+PASS. WebKit didn't crash.
Copied: branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-body-replacement2.html (from rev 106972, trunk/LayoutTests/fast/dom/remove-body-during-body-replacement2.html) (0 => 107343)
--- branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-body-replacement2.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/dom/remove-body-during-body-replacement2.html 2012-02-10 02:47:04 UTC (rev 107343)
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<body><div><script>
+
+if (!window.layoutTestController)
+ document.write("This test requires GCController.");
+else {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+
+ function crash() {
+ document.open();
+ document.write("PASS. WebKit didn't crash.");
+ document.close();
+ GCController.collect();
+ setTimeout("layoutTestController.notifyDone()", 0);
+ }
+
+ setTimeout(function () {
+ document.addEventListener('DOMFocusOut', function () { crash(); }, true);
+ document.addEventListener('DOMSubtreeModified', function () { /* noop */ }, false);
+ document.designMode = "on";
+ document.execCommand("SelectAll");
+ document.body.outerText = "ABC";
+ }, 0);
+}
+
+</script>
+</body>
+</html>
Modified: branches/chromium/1025/Source/WebCore/dom/ContainerNode.cpp (107342 => 107343)
--- branches/chromium/1025/Source/WebCore/dom/ContainerNode.cpp 2012-02-10 02:45:14 UTC (rev 107342)
+++ branches/chromium/1025/Source/WebCore/dom/ContainerNode.cpp 2012-02-10 02:47:04 UTC (rev 107343)
@@ -116,6 +116,8 @@
// If it is, it can be deleted as a side effect of sending mutation events.
ASSERT(refCount() || parentOrHostNode());
+ RefPtr<Node> protect(this);
+
ec = 0;
// insertBefore(node, 0) is equivalent to appendChild(node)
@@ -261,6 +263,8 @@
// If it is, it can be deleted as a side effect of sending mutation events.
ASSERT(refCount() || parentOrHostNode());
+ RefPtr<Node> protect(this);
+
ec = 0;
if (oldChild == newChild) // nothing to do
@@ -427,6 +431,8 @@
// If it is, it can be deleted as a side effect of sending mutation events.
ASSERT(refCount() || parentOrHostNode());
+ RefPtr<Node> protect(this);
+
ec = 0;
// NO_MODIFICATION_ALLOWED_ERR: Raised if this node is readonly.
@@ -605,7 +611,7 @@
bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
{
- RefPtr<ContainerNode> protector(this);
+ RefPtr<ContainerNode> protect(this);
// Check that this node is not "floating".
// If it is, it can be deleted as a side effect of sending mutation events.
