Diff
Copied: branches/chromium/963/LayoutTests/fast/dom/getElementById-consistency-expected.txt (from rev 108152, trunk/LayoutTests/fast/dom/getElementById-consistency-expected.txt) (0 => 109354)
--- branches/chromium/963/LayoutTests/fast/dom/getElementById-consistency-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/dom/getElementById-consistency-expected.txt 2012-03-01 17:49:11 UTC (rev 109354)
@@ -0,0 +1,11 @@
+Test that DOMSubtreeModified listeners cannot cause inDocument to be incorrect
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS document.contains(document.getElementById('el')) is true
+PASS document.getElementById('el') is null
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/chromium/963/LayoutTests/fast/dom/getElementById-consistency.html (from rev 108152, trunk/LayoutTests/fast/dom/getElementById-consistency.html) (0 => 109354)
--- branches/chromium/963/LayoutTests/fast/dom/getElementById-consistency.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/dom/getElementById-consistency.html 2012-03-01 17:49:11 UTC (rev 109354)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<script src=""
+<div id=container>
+</div>
+<span id=el>
+</span>
+<script>
+description('Test that DOMSubtreeModified listeners cannot cause inDocument to be incorrect');
+
+var counter = 0;
+var container = document.getElementById('container');
+var el = document.getElementById('el');
+function broken() {
+ if (++counter > 2) {
+ document.removeEventListener('DOMSubtreeModified', broken, true);
+ return;
+ }
+ container.appendChild(el);
+}
+
+document.addEventListener("DOMSubtreeModified", broken, true);
+broken();
+shouldBeTrue("document.contains(document.getElementById('el'))");
+el.parentNode.removeChild(el);
+el = null;
+gc();
+shouldBeNull("document.getElementById('el')");
+</script>
+<script src=""
Copied: branches/chromium/963/LayoutTests/fast/dom/getElementById-consistency2-expected.txt (from rev 108152, trunk/LayoutTests/fast/dom/getElementById-consistency2-expected.txt) (0 => 109354)
--- branches/chromium/963/LayoutTests/fast/dom/getElementById-consistency2-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/dom/getElementById-consistency2-expected.txt 2012-03-01 17:49:11 UTC (rev 109354)
@@ -0,0 +1,11 @@
+Test that DOMSubtreeModified listeners cannot cause DocumentOrderedMap to be incorrect
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS document.contains(el) is true
+PASS document.getElementById('el') is null
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/chromium/963/LayoutTests/fast/dom/getElementById-consistency2.html (from rev 108152, trunk/LayoutTests/fast/dom/getElementById-consistency2.html) (0 => 109354)
--- branches/chromium/963/LayoutTests/fast/dom/getElementById-consistency2.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/dom/getElementById-consistency2.html 2012-03-01 17:49:11 UTC (rev 109354)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<script src=""
+<div id=container>
+</div>
+<span id=el>
+</span>
+<script>
+description('Test that DOMSubtreeModified listeners cannot cause DocumentOrderedMap to be incorrect');
+
+var counter = 0;
+var container = document.getElementById('container');
+var el = document.getElementById('el');
+function broken() {
+ if (++counter > 2) {
+ document.removeEventListener('DOMSubtreeModified', broken, true);
+ return;
+ }
+ container.appendChild(el);
+}
+
+document.addEventListener("DOMSubtreeModified", broken, true);
+broken();
+shouldBeTrue("document.contains(el)");
+el.parentNode.removeChild(el);
+el = null;
+gc();
+shouldBeNull("document.getElementById('el')");
+</script>
+<script src=""
Modified: branches/chromium/963/Source/WebCore/dom/ContainerNode.cpp (109353 => 109354)
--- branches/chromium/963/Source/WebCore/dom/ContainerNode.cpp 2012-03-01 17:42:57 UTC (rev 109353)
+++ branches/chromium/963/Source/WebCore/dom/ContainerNode.cpp 2012-03-01 17:49:11 UTC (rev 109354)
@@ -479,15 +479,15 @@
Node* next = child->nextSibling();
removeBetween(prev, next, child.get());
- // Dispatch post-removal mutation events
- childrenChanged(false, prev, next, -1);
- dispatchSubtreeModifiedEvent();
-
if (child->inDocument())
child->removedFromDocument();
else
child->removedFromTree(true);
+ // Dispatch post-removal mutation events
+ childrenChanged(false, prev, next, -1);
+ dispatchSubtreeModifiedEvent();
+
return child;
}
Modified: branches/chromium/963/Source/WebCore/svg/SVGTRefElement.cpp (109353 => 109354)
--- branches/chromium/963/Source/WebCore/svg/SVGTRefElement.cpp 2012-03-01 17:42:57 UTC (rev 109353)
+++ branches/chromium/963/Source/WebCore/svg/SVGTRefElement.cpp 2012-03-01 17:49:11 UTC (rev 109354)
@@ -146,10 +146,8 @@
void SVGTRefElement::updateReferencedText()
{
- Element* target = SVGURIReference::targetElementFromIRIString(href(), document());
- ASSERT(target);
String textContent;
- if (target->parentNode())
+ if (Element* target = SVGURIReference::targetElementFromIRIString(href(), document()))
textContent = target->textContent();
ExceptionCode ignore = 0;
if (!ensureShadowRoot()->firstChild())
