Diff
Copied: branches/chromium/1229/LayoutTests/fast/frames/iframe-onload-and-domnodeinserted-expected.txt (from rev 126131, trunk/LayoutTests/fast/frames/iframe-onload-and-domnodeinserted-expected.txt) (0 => 126677)
--- branches/chromium/1229/LayoutTests/fast/frames/iframe-onload-and-domnodeinserted-expected.txt (rev 0)
+++ branches/chromium/1229/LayoutTests/fast/frames/iframe-onload-and-domnodeinserted-expected.txt 2012-08-25 02:35:00 UTC (rev 126677)
@@ -0,0 +1,11 @@
+This test ensures that any tree mutation in the load event handler cannot harm the tree consistency.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS loadEventFired is true
+PASS unless crash.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/chromium/1229/LayoutTests/fast/frames/iframe-onload-and-domnodeinserted.html (from rev 126131, trunk/LayoutTests/fast/frames/iframe-onload-and-domnodeinserted.html) (0 => 126677)
--- branches/chromium/1229/LayoutTests/fast/frames/iframe-onload-and-domnodeinserted.html (rev 0)
+++ branches/chromium/1229/LayoutTests/fast/frames/iframe-onload-and-domnodeinserted.html 2012-08-25 02:35:00 UTC (rev 126677)
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<div id="g"></div>
+<script>
+description("This test ensures that any tree mutation in the load event handler cannot harm the tree consistency.")
+var docElement = document.documentElement;
+
+textareaElement = document.createElement("textarea");
+iframeElement = document.createElement("iframe");
+
+var loadEventFired = false;
+textareaElement.appendChild(iframeElement);
+iframeElement.addEventListener("load", function () { iframeElement.innerHTML = "X"; loadEventFired = true; }, false);
+textareaElement.addEventListener("DOMNodeInserted", function () { document.implementation.createDocument("", "", null).adoptNode(textareaElement) }, false);
+document.documentElement.appendChild(textareaElement); // The DOMNodeInserted event is triggered here through innerHTML = "X"
+document.getElementById("g").appendChild(textareaElement);
+shouldBeTrue("loadEventFired");
+debug("PASS unless crash.");
+</script>
+<script src=""
+</body>
+</html>
Modified: branches/chromium/1229/Source/WebCore/dom/ContainerNodeAlgorithms.h (126676 => 126677)
--- branches/chromium/1229/Source/WebCore/dom/ContainerNodeAlgorithms.h 2012-08-25 02:27:56 UTC (rev 126676)
+++ branches/chromium/1229/Source/WebCore/dom/ContainerNodeAlgorithms.h 2012-08-25 02:35:00 UTC (rev 126677)
@@ -46,6 +46,7 @@
void notifyNodeInsertedIntoTree(ContainerNode*);
ContainerNode* m_insertionPoint;
+ Vector< RefPtr<Node> > m_postInsertionNotificationTargets;
};
class ChildNodeRemovalNotifier {
@@ -197,8 +198,16 @@
if (node->isContainerNode())
notifyDescendantInsertedIntoDocument(toContainerNode(node));
- if (request == Node::InsertionShouldCallDidNotifyDescendantInsertions)
+ switch (request) {
+ case Node::InsertionDone:
+ break;
+ case Node::InsertionShouldCallDidNotifyDescendantInsertions:
node->didNotifyDescendantInsertions(m_insertionPoint);
+ break;
+ case Node::InsertionShouldCallDidNotifySubtreeInsertions:
+ m_postInsertionNotificationTargets.append(node);
+ break;
+ }
}
inline void ChildNodeInsertionNotifier::notifyNodeInsertedIntoTree(ContainerNode* node)
@@ -235,6 +244,9 @@
notifyNodeInsertedIntoDocument(node);
else if (node->isContainerNode())
notifyNodeInsertedIntoTree(toContainerNode(node));
+
+ for (size_t i = 0; i < m_postInsertionNotificationTargets.size(); ++i)
+ m_postInsertionNotificationTargets[i]->didNotifySubtreeInsertions(m_insertionPoint);
}
Modified: branches/chromium/1229/Source/WebCore/dom/Node.h (126676 => 126677)
--- branches/chromium/1229/Source/WebCore/dom/Node.h 2012-08-25 02:27:56 UTC (rev 126676)
+++ branches/chromium/1229/Source/WebCore/dom/Node.h 2012-08-25 02:35:00 UTC (rev 126677)
@@ -544,11 +544,13 @@
//
enum InsertionNotificationRequest {
InsertionDone,
- InsertionShouldCallDidNotifyDescendantInsertions
+ InsertionShouldCallDidNotifyDescendantInsertions,
+ InsertionShouldCallDidNotifySubtreeInsertions
};
virtual InsertionNotificationRequest insertedInto(ContainerNode* insertionPoint);
virtual void didNotifyDescendantInsertions(ContainerNode*) { }
+ virtual void didNotifySubtreeInsertions(ContainerNode*) { }
// Notifies the node that it is no longer part of the tree.
//
Modified: branches/chromium/1229/Source/WebCore/html/HTMLFrameElementBase.cpp (126676 => 126677)
--- branches/chromium/1229/Source/WebCore/html/HTMLFrameElementBase.cpp 2012-08-25 02:27:56 UTC (rev 126676)
+++ branches/chromium/1229/Source/WebCore/html/HTMLFrameElementBase.cpp 2012-08-25 02:35:00 UTC (rev 126677)
@@ -157,11 +157,11 @@
{
HTMLFrameOwnerElement::insertedInto(insertionPoint);
if (insertionPoint->inDocument())
- return InsertionShouldCallDidNotifyDescendantInsertions;
+ return InsertionShouldCallDidNotifySubtreeInsertions;
return InsertionDone;
}
-void HTMLFrameElementBase::didNotifyDescendantInsertions(ContainerNode* insertionPoint)
+void HTMLFrameElementBase::didNotifySubtreeInsertions(ContainerNode* insertionPoint)
{
ASSERT_UNUSED(insertionPoint, insertionPoint->inDocument());
Modified: branches/chromium/1229/Source/WebCore/html/HTMLFrameElementBase.h (126676 => 126677)
--- branches/chromium/1229/Source/WebCore/html/HTMLFrameElementBase.h 2012-08-25 02:27:56 UTC (rev 126676)
+++ branches/chromium/1229/Source/WebCore/html/HTMLFrameElementBase.h 2012-08-25 02:35:00 UTC (rev 126677)
@@ -51,7 +51,7 @@
virtual void parseAttribute(const Attribute&) OVERRIDE;
virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
- virtual void didNotifyDescendantInsertions(ContainerNode*) OVERRIDE;
+ virtual void didNotifySubtreeInsertions(ContainerNode*) OVERRIDE;
virtual void attach();
private:
