Title: [128807] branches/chromium/1229
- Revision
- 128807
- Author
- [email protected]
- Date
- 2012-09-17 14:32:05 -0700 (Mon, 17 Sep 2012)
Log Message
Merge 128524
BUG=139814
Review URL: https://codereview.chromium.org/10907267
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1229/LayoutTests/plugins/plugin-remove-readystatechange-expected.txt (from rev 128524, trunk/LayoutTests/plugins/plugin-remove-readystatechange-expected.txt) (0 => 128807)
--- branches/chromium/1229/LayoutTests/plugins/plugin-remove-readystatechange-expected.txt (rev 0)
+++ branches/chromium/1229/LayoutTests/plugins/plugin-remove-readystatechange-expected.txt 2012-09-17 21:32:05 UTC (rev 128807)
@@ -0,0 +1,3 @@
+ALERT: PASS: element could not be re-appended
+This test passes if it does not trip an assert in debug builds. It ensures a readystatechange event can't get dispatched until after a plugin is fully removed.
+
Copied: branches/chromium/1229/LayoutTests/plugins/plugin-remove-readystatechange.html (from rev 128524, trunk/LayoutTests/plugins/plugin-remove-readystatechange.html) (0 => 128807)
--- branches/chromium/1229/LayoutTests/plugins/plugin-remove-readystatechange.html (rev 0)
+++ branches/chromium/1229/LayoutTests/plugins/plugin-remove-readystatechange.html 2012-09-17 21:32:05 UTC (rev 128807)
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div>
+This test passes if it does not trip an assert in debug builds.
+It ensures a readystatechange event can't get dispatched until after a plugin is fully removed.
+</div>
+<embed id="viewer" src=""
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+var i = 0;
+document.addEventListener('readystatechange', function() {
+ if (i == 1) {
+ try {
+ document.body.appendChild(document.getElementById('viewer'));
+ }
+ catch (e) {
+ alert('PASS: element could not be re-appended');
+ }
+ }
+ i++;
+});
+
+window.addEventListener('DOMContentLoaded', function() {
+ document.body.removeChild(document.getElementById('viewer'));
+});
+</script>
+</body>
+</html>
Modified: branches/chromium/1229/Source/WebCore/dom/ContainerNode.cpp (128806 => 128807)
--- branches/chromium/1229/Source/WebCore/dom/ContainerNode.cpp 2012-09-17 21:31:14 UTC (rev 128806)
+++ branches/chromium/1229/Source/WebCore/dom/ContainerNode.cpp 2012-09-17 21:32:05 UTC (rev 128807)
@@ -39,6 +39,7 @@
#include "Page.h"
#include "RenderBox.h"
#include "RenderTheme.h"
+#include "RenderWidget.h"
#include "RootInlineBox.h"
#include <wtf/CurrentTime.h>
#include <wtf/Vector.h>
@@ -407,13 +408,15 @@
return false;
}
+ RenderWidget::suspendWidgetHierarchyUpdates();
+
Node* prev = child->previousSibling();
Node* next = child->nextSibling();
removeBetween(prev, next, child.get());
-
childrenChanged(false, prev, next, -1);
+ ChildNodeRemovalNotifier(this).notify(child.get());
- ChildNodeRemovalNotifier(this).notify(child.get());
+ RenderWidget::resumeWidgetHierarchyUpdates();
dispatchSubtreeModifiedEvent();
return child;
@@ -483,6 +486,7 @@
// and remove... e.g. stop loading frames, fire unload events.
willRemoveChildren(protect.get());
+ RenderWidget::suspendWidgetHierarchyUpdates();
forbidEventDispatch();
Vector<RefPtr<Node>, 10> removedChildren;
removedChildren.reserveInitialCapacity(childNodeCount());
@@ -524,6 +528,8 @@
ChildNodeRemovalNotifier(this).notify(removedChildren[i].get());
allowEventDispatch();
+ RenderWidget::resumeWidgetHierarchyUpdates();
+
dispatchSubtreeModifiedEvent();
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
