Title: [124339] trunk
- Revision
- 124339
- Author
- [email protected]
- Date
- 2012-08-01 09:40:15 -0700 (Wed, 01 Aug 2012)
Log Message
REGRESSION(r122498): Assertion failure: m_nodeListCounts is sometimes not zero in the Document destructor
https://bugs.webkit.org/show_bug.cgi?id=92742
Reviewed by Andreas Kling.
Source/WebCore:
The bug was caused by adoptTreeScope's not always calling unregisterNodeListCache and registerNodeListCache
on node lists that use m_atomicNameCaches and m_nameCaches.
Tests: fast/dom/NodeList/nodelist-moved-to-fragment-2.html
fast/dom/NodeList/nodelist-moved-to-fragment.html
* dom/NodeRareData.h:
(WebCore::NodeListsNodeData::adoptTreeScope):
LayoutTests:
Add regression tests for two types of node lists: one that uses addCacheWithName and the other that uses
addCacheWithAtomicName.
* fast/dom/NodeList/nodelist-moved-to-fragment-2-expected.txt: Added.
* fast/dom/NodeList/nodelist-moved-to-fragment-2.html: Added.
* fast/dom/NodeList/nodelist-moved-to-fragment-expected.txt: Added.
* fast/dom/NodeList/nodelist-moved-to-fragment.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (124338 => 124339)
--- trunk/LayoutTests/ChangeLog 2012-08-01 16:15:05 UTC (rev 124338)
+++ trunk/LayoutTests/ChangeLog 2012-08-01 16:40:15 UTC (rev 124339)
@@ -1,3 +1,18 @@
+2012-08-01 Ryosuke Niwa <[email protected]>
+
+ REGRESSION(r122498): Assertion failure: m_nodeListCounts is sometimes not zero in the Document destructor
+ https://bugs.webkit.org/show_bug.cgi?id=92742
+
+ Reviewed by Andreas Kling.
+
+ Add regression tests for two types of node lists: one that uses addCacheWithName and the other that uses
+ addCacheWithAtomicName.
+
+ * fast/dom/NodeList/nodelist-moved-to-fragment-2-expected.txt: Added.
+ * fast/dom/NodeList/nodelist-moved-to-fragment-2.html: Added.
+ * fast/dom/NodeList/nodelist-moved-to-fragment-expected.txt: Added.
+ * fast/dom/NodeList/nodelist-moved-to-fragment.html: Added.
+
2012-08-01 Zeno Albisser <[email protected]>
[Qt]REGRESSION(r123786): It made 3 fast/animation tests fail.
Added: trunk/LayoutTests/fast/dom/NodeList/nodelist-moved-to-fragment-2-expected.txt (0 => 124339)
--- trunk/LayoutTests/fast/dom/NodeList/nodelist-moved-to-fragment-2-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/NodeList/nodelist-moved-to-fragment-2-expected.txt 2012-08-01 16:40:15 UTC (rev 124339)
@@ -0,0 +1,4 @@
+This tests moving a node list that uses string gets adopted to a new document properly.
+The test passes if WebKit does not hit an assertion.
+
+PASS
Added: trunk/LayoutTests/fast/dom/NodeList/nodelist-moved-to-fragment-2.html (0 => 124339)
--- trunk/LayoutTests/fast/dom/NodeList/nodelist-moved-to-fragment-2.html (rev 0)
+++ trunk/LayoutTests/fast/dom/NodeList/nodelist-moved-to-fragment-2.html 2012-08-01 16:40:15 UTC (rev 124339)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<body _onload_="runTest()">
+<p>This tests moving a node list that uses string gets adopted to a new document properly.<br>
+The test passes if WebKit does not hit an assertion.</p>
+<script>
+
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+
+function runTest()
+{
+ var newDocument = document.implementation.createDocument(null, "someElement", null);
+ var fragment = document.createDocumentFragment();
+ newDocument.documentElement.getElementsByClassName("foo");
+ fragment.appendChild(newDocument.documentElement);
+
+ setTimeout(function () {
+ document.querySelector('p').innerHTML += '<br><br>PASS';
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }, 0);
+}
+
+</script>
+</body>
+</html>
Added: trunk/LayoutTests/fast/dom/NodeList/nodelist-moved-to-fragment-expected.txt (0 => 124339)
--- trunk/LayoutTests/fast/dom/NodeList/nodelist-moved-to-fragment-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/NodeList/nodelist-moved-to-fragment-expected.txt 2012-08-01 16:40:15 UTC (rev 124339)
@@ -0,0 +1,4 @@
+This tests moving a node list that uses atomic string gets adopted to a new document properly.
+The test passes if WebKit does not hit an assertion.
+
+PASS
Added: trunk/LayoutTests/fast/dom/NodeList/nodelist-moved-to-fragment.html (0 => 124339)
--- trunk/LayoutTests/fast/dom/NodeList/nodelist-moved-to-fragment.html (rev 0)
+++ trunk/LayoutTests/fast/dom/NodeList/nodelist-moved-to-fragment.html 2012-08-01 16:40:15 UTC (rev 124339)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<body _onload_="runTest()">
+<p>This tests moving a node list that uses atomic string gets adopted to a new document properly.<br>
+The test passes if WebKit does not hit an assertion.</p>
+<script>
+
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+
+function runTest()
+{
+ var newDocument = document.implementation.createDocument(null, "someElement", null);
+ var fragment = document.createDocumentFragment();
+ newDocument.documentElement.getElementsByTagName("foo");
+ fragment.appendChild(newDocument.documentElement);
+
+ setTimeout(function () {
+ document.querySelector('p').innerHTML += '<br><br>PASS';
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }, 0);
+}
+
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (124338 => 124339)
--- trunk/Source/WebCore/ChangeLog 2012-08-01 16:15:05 UTC (rev 124338)
+++ trunk/Source/WebCore/ChangeLog 2012-08-01 16:40:15 UTC (rev 124339)
@@ -1,3 +1,19 @@
+2012-08-01 Ryosuke Niwa <[email protected]>
+
+ REGRESSION(r122498): Assertion failure: m_nodeListCounts is sometimes not zero in the Document destructor
+ https://bugs.webkit.org/show_bug.cgi?id=92742
+
+ Reviewed by Andreas Kling.
+
+ The bug was caused by adoptTreeScope's not always calling unregisterNodeListCache and registerNodeListCache
+ on node lists that use m_atomicNameCaches and m_nameCaches.
+
+ Tests: fast/dom/NodeList/nodelist-moved-to-fragment-2.html
+ fast/dom/NodeList/nodelist-moved-to-fragment.html
+
+ * dom/NodeRareData.h:
+ (WebCore::NodeListsNodeData::adoptTreeScope):
+
2012-08-01 Vsevolod Vlasov <[email protected]>
Web Inspector: Crashes in NetworkResourcesData.
Modified: trunk/Source/WebCore/dom/NodeRareData.h (124338 => 124339)
--- trunk/Source/WebCore/dom/NodeRareData.h 2012-08-01 16:15:05 UTC (rev 124338)
+++ trunk/Source/WebCore/dom/NodeRareData.h 2012-08-01 16:40:15 UTC (rev 124339)
@@ -137,19 +137,15 @@
NodeListAtomicNameCacheMap::const_iterator atomicNameCacheEnd = m_atomicNameCaches.end();
for (NodeListAtomicNameCacheMap::const_iterator it = m_atomicNameCaches.begin(); it != atomicNameCacheEnd; ++it) {
DynamicSubtreeNodeList* list = it->second;
- if (list->isRootedAtDocument()) {
- oldDocument->unregisterNodeListCache(list);
- newDocument->registerNodeListCache(list);
- }
+ oldDocument->unregisterNodeListCache(list);
+ newDocument->registerNodeListCache(list);
}
NodeListNameCacheMap::const_iterator nameCacheEnd = m_nameCaches.end();
for (NodeListNameCacheMap::const_iterator it = m_nameCaches.begin(); it != nameCacheEnd; ++it) {
DynamicSubtreeNodeList* list = it->second;
- if (list->isRootedAtDocument()) {
- oldDocument->unregisterNodeListCache(list);
- newDocument->registerNodeListCache(list);
- }
+ oldDocument->unregisterNodeListCache(list);
+ newDocument->registerNodeListCache(list);
}
TagNodeListCacheNS::const_iterator tagEnd = m_tagNodeListCacheNS.end();
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
