Diff
Modified: releases/WebKitGTK/webkit-1.8/LayoutTests/ChangeLog (117755 => 117756)
--- releases/WebKitGTK/webkit-1.8/LayoutTests/ChangeLog 2012-05-21 10:44:10 UTC (rev 117755)
+++ releases/WebKitGTK/webkit-1.8/LayoutTests/ChangeLog 2012-05-21 10:47:25 UTC (rev 117756)
@@ -1,3 +1,15 @@
+2012-04-11 Erik Arvidsson <[email protected]>
+
+ StyleElement ownerNode is not cleared correctly
+ https://bugs.webkit.org/show_bug.cgi?id=83696
+
+ Reviewed by Antti Koivisto.
+
+ * fast/dom/StyleSheet/detached-sheet-owner-node-expected.txt: Added.
+ * fast/dom/StyleSheet/detached-sheet-owner-node-link-expected.txt: Added.
+ * fast/dom/StyleSheet/detached-sheet-owner-node-link.html: Added.
+ * fast/dom/StyleSheet/detached-sheet-owner-node.html: Added.
+
2012-04-03 Abhishek Arya <[email protected]>
Crash in SelectorChecker::checkOneSelector.
Added: releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node-expected.txt (0 => 117756)
--- releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node-expected.txt 2012-05-21 10:47:25 UTC (rev 117756)
@@ -0,0 +1,9 @@
+This tests that accessing ownerNode on a disconnected style sheet does not crash
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node-link-expected.txt (0 => 117756)
--- releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node-link-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node-link-expected.txt 2012-05-21 10:47:25 UTC (rev 117756)
@@ -0,0 +1,9 @@
+This tests that accessing ownerNode on a disconnected style sheet does not crash
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node-link.html (0 => 117756)
--- releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node-link.html (rev 0)
+++ releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node-link.html 2012-05-21 10:47:25 UTC (rev 117756)
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<script src=""
+<script>
+
+description('This tests that accessing ownerNode on a disconnected style sheet does not crash');
+
+jsTestIsAsync = true;
+
+window._onload_ = function() {
+ var innerDocument = document.querySelector('iframe').contentDocument;
+ document.body.removeChild(document.querySelector('iframe'));
+
+ innerDocument.querySelector('link').rel = 'icon'; // this triggers process
+ innerDocument.documentElement.textContent = '';
+
+ gc();
+ innerDocument.styleSheets[0] && innerDocument.styleSheets[0].ownerNode;
+ finishJSTest();
+};
+
+</script>
+<iframe src="" rel='stylesheet' href=''>"></iframe>
+<script src=""
\ No newline at end of file
Added: releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node.html (0 => 117756)
--- releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node.html (rev 0)
+++ releases/WebKitGTK/webkit-1.8/LayoutTests/fast/dom/StyleSheet/detached-sheet-owner-node.html 2012-05-21 10:47:25 UTC (rev 117756)
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<script src=""
+<script>
+
+description('This tests that accessing ownerNode on a disconnected style sheet does not crash');
+
+jsTestIsAsync = true;
+
+window._onload_ = function() {
+ var innerDocument = document.querySelector('iframe').contentDocument;
+ document.body.removeChild(document.querySelector('iframe'));
+
+ innerDocument.querySelector('style').textContent = ''; // this triggers createSheet
+ innerDocument.documentElement.textContent = '';
+
+ gc();
+ innerDocument.styleSheets[0] && innerDocument.styleSheets[0].ownerNode;
+ finishJSTest();
+};
+
+</script>
+<iframe src=""
+<script src=""
\ No newline at end of file
Modified: releases/WebKitGTK/webkit-1.8/Source/WebCore/ChangeLog (117755 => 117756)
--- releases/WebKitGTK/webkit-1.8/Source/WebCore/ChangeLog 2012-05-21 10:44:10 UTC (rev 117755)
+++ releases/WebKitGTK/webkit-1.8/Source/WebCore/ChangeLog 2012-05-21 10:47:25 UTC (rev 117756)
@@ -1,3 +1,31 @@
+2012-04-11 Erik Arvidsson <[email protected]>
+
+ StyleElement ownerNode is not cleared correctly
+ https://bugs.webkit.org/show_bug.cgi?id=83696
+
+ Reviewed by Antti Koivisto.
+
+ When the css text changes in such a way that we remove the sheet of a style element or a link[rel=stylesheet]
+ element we need to ensure that the ownerNode of the sheet is cleared. If we don't do this and there is a
+ wrapper for the sheet the sheet is kept alive but the ownerNode of the sheet may point to a deleted node.
+
+ Tests: fast/dom/StyleSheet/detached-sheet-owner-node-link.html
+ fast/dom/StyleSheet/detached-sheet-owner-node.html
+
+ * dom/StyleElement.cpp:
+ (WebCore::StyleElement::removedFromDocument):
+ (WebCore::StyleElement::clearSheet):
+ (WebCore):
+ (WebCore::StyleElement::createSheet):
+ * dom/StyleElement.h:
+ (StyleElement):
+ * html/HTMLLinkElement.cpp:
+ (WebCore::HTMLLinkElement::process):
+ (WebCore::HTMLLinkElement::clearSheet):
+ (WebCore):
+ * html/HTMLLinkElement.h:
+ (HTMLLinkElement):
+
2012-04-03 Abhishek Arya <[email protected]>
Crash in SelectorChecker::checkOneSelector.
Modified: releases/WebKitGTK/webkit-1.8/Source/WebCore/dom/StyleElement.cpp (117755 => 117756)
--- releases/WebKitGTK/webkit-1.8/Source/WebCore/dom/StyleElement.cpp 2012-05-21 10:44:10 UTC (rev 117755)
+++ releases/WebKitGTK/webkit-1.8/Source/WebCore/dom/StyleElement.cpp 2012-05-21 10:47:25 UTC (rev 117756)
@@ -74,11 +74,8 @@
ASSERT(element);
document->removeStyleSheetCandidateNode(element);
- if (m_sheet) {
- ASSERT(m_sheet->ownerNode() == element);
- m_sheet->clearOwnerNode();
- m_sheet = 0;
- }
+ if (m_sheet)
+ clearSheet();
// If we're in document teardown, then we don't need to do any notification of our sheet's removal.
if (document->renderer())
@@ -139,6 +136,13 @@
createSheet(e, m_startLineNumber, sheetText.toString());
}
+void StyleElement::clearSheet()
+{
+ ASSERT(m_sheet);
+ m_sheet->clearOwnerNode();
+ m_sheet = 0;
+}
+
void StyleElement::createSheet(Element* e, int startLineNumber, const String& text)
{
ASSERT(e);
@@ -147,7 +151,7 @@
if (m_sheet) {
if (m_sheet->isLoading())
document->removePendingSheet();
- m_sheet = 0;
+ clearSheet();
}
// If type is empty or CSS, this is a CSS style sheet.
Modified: releases/WebKitGTK/webkit-1.8/Source/WebCore/dom/StyleElement.h (117755 => 117756)
--- releases/WebKitGTK/webkit-1.8/Source/WebCore/dom/StyleElement.h 2012-05-21 10:44:10 UTC (rev 117755)
+++ releases/WebKitGTK/webkit-1.8/Source/WebCore/dom/StyleElement.h 2012-05-21 10:47:25 UTC (rev 117756)
@@ -54,6 +54,7 @@
private:
void createSheet(Element*, int startLineNumber, const String& text = String());
void process(Element*);
+ void clearSheet();
bool m_createdByParser;
bool m_loading;
Modified: releases/WebKitGTK/webkit-1.8/Source/WebCore/html/HTMLLinkElement.cpp (117755 => 117756)
--- releases/WebKitGTK/webkit-1.8/Source/WebCore/html/HTMLLinkElement.cpp 2012-05-21 10:44:10 UTC (rev 117755)
+++ releases/WebKitGTK/webkit-1.8/Source/WebCore/html/HTMLLinkElement.cpp 2012-05-21 10:47:25 UTC (rev 117756)
@@ -223,11 +223,19 @@
}
} else if (m_sheet) {
// we no longer contain a stylesheet, e.g. perhaps rel or type was changed
- m_sheet = 0;
+ clearSheet();
document()->styleSelectorChanged(DeferRecalcStyle);
}
}
+void HTMLLinkElement::clearSheet()
+{
+ ASSERT(m_sheet);
+ ASSERT(m_sheet->ownerNode() == this);
+ m_sheet->clearOwnerNode();
+ m_sheet = 0;
+}
+
void HTMLLinkElement::insertedIntoDocument()
{
HTMLElement::insertedIntoDocument();
@@ -251,11 +259,8 @@
}
document()->removeStyleSheetCandidateNode(this);
- if (m_sheet) {
- ASSERT(m_sheet->ownerNode() == this);
- m_sheet->clearOwnerNode();
- m_sheet = 0;
- }
+ if (m_sheet)
+ clearSheet();
if (document()->renderer())
document()->styleSelectorChanged(DeferRecalcStyle);
Modified: releases/WebKitGTK/webkit-1.8/Source/WebCore/html/HTMLLinkElement.h (117755 => 117756)
--- releases/WebKitGTK/webkit-1.8/Source/WebCore/html/HTMLLinkElement.h 2012-05-21 10:44:10 UTC (rev 117755)
+++ releases/WebKitGTK/webkit-1.8/Source/WebCore/html/HTMLLinkElement.h 2012-05-21 10:47:25 UTC (rev 117756)
@@ -66,6 +66,7 @@
virtual bool shouldLoadLink();
void process();
static void processCallback(Node*);
+ void clearSheet();
virtual void insertedIntoDocument();
virtual void removedFromDocument();
