Title: [136285] branches/chromium/1312
- Revision
- 136285
- Author
- [email protected]
- Date
- 2012-11-30 15:12:15 -0800 (Fri, 30 Nov 2012)
Log Message
Merge 135914
BUG=158695
Review URL: https://codereview.chromium.org/11415245
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1312/LayoutTests/fast/dom/adopt-node-crash-2-expected.txt (from rev 135914, trunk/LayoutTests/fast/dom/adopt-node-crash-2-expected.txt) (0 => 136285)
--- branches/chromium/1312/LayoutTests/fast/dom/adopt-node-crash-2-expected.txt (rev 0)
+++ branches/chromium/1312/LayoutTests/fast/dom/adopt-node-crash-2-expected.txt 2012-11-30 23:12:15 UTC (rev 136285)
@@ -0,0 +1,2 @@
+Tests for a crash due to adopting a DOM node during DOMFocusOut event. Test passes if it doesn't crash.
+
Copied: branches/chromium/1312/LayoutTests/fast/dom/adopt-node-crash-2.html (from rev 135914, trunk/LayoutTests/fast/dom/adopt-node-crash-2.html) (0 => 136285)
--- branches/chromium/1312/LayoutTests/fast/dom/adopt-node-crash-2.html (rev 0)
+++ branches/chromium/1312/LayoutTests/fast/dom/adopt-node-crash-2.html 2012-11-30 23:12:15 UTC (rev 136285)
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<div>Tests for a crash due to adopting a DOM node during DOMFocusOut event. Test passes if it doesn't crash.</div>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+</script>
+<div id="div1"></div>
+<div id="div2">
+ <applet>
+ <iframe srcdoc="<iframe srcdoc=''>">
+ </iframe>
+ </applet>
+ <header id="header1">
+ <keygen autofocus>
+ </header>
+</div>
+<script>
+function doit()
+{
+ div2.addEventListener("DOMFocusOut", function () { document.implementation.createDocument("", "", null).adoptNode(div2); }, false);
+ div1.outerHTML = header1.outerHTML;
+ if (window.testRunner)
+ testRunner.notifyDone();
+}
+document.addEventListener("DOMContentLoaded", setTimeout("doit()", 1), false);
+</script>
+</html>
Modified: branches/chromium/1312/Source/WebCore/dom/Element.cpp (136284 => 136285)
--- branches/chromium/1312/Source/WebCore/dom/Element.cpp 2012-11-30 23:12:13 UTC (rev 136284)
+++ branches/chromium/1312/Source/WebCore/dom/Element.cpp 2012-11-30 23:12:15 UTC (rev 136285)
@@ -986,33 +986,33 @@
void Element::attach()
{
suspendPostAttachCallbacks();
- WidgetHierarchyUpdatesSuspensionScope suspendWidgetHierarchyUpdates;
+ {
+ WidgetHierarchyUpdatesSuspensionScope suspendWidgetHierarchyUpdates;
+ createRendererIfNeeded();
- createRendererIfNeeded();
- StyleResolverParentPusher parentPusher(this);
+ StyleResolverParentPusher parentPusher(this);
+ if (parentElement() && parentElement()->isInCanvasSubtree())
+ setIsInCanvasSubtree(true);
- if (parentElement() && parentElement()->isInCanvasSubtree())
- setIsInCanvasSubtree(true);
-
- // When a shadow root exists, it does the work of attaching the children.
- if (ElementShadow* shadow = this->shadow()) {
- parentPusher.push();
- shadow->attach();
- } else {
- if (firstChild())
+ // When a shadow root exists, it does the work of attaching the children.
+ if (ElementShadow* shadow = this->shadow()) {
parentPusher.push();
- }
- ContainerNode::attach();
+ shadow->attach();
+ } else {
+ if (firstChild())
+ parentPusher.push();
+ }
+ ContainerNode::attach();
- if (hasRareData()) {
- ElementRareData* data = ""
- if (data->needsFocusAppearanceUpdateSoonAfterAttach()) {
- if (isFocusable() && document()->focusedNode() == this)
- document()->updateFocusAppearanceSoon(false /* don't restore selection */);
- data->setNeedsFocusAppearanceUpdateSoonAfterAttach(false);
+ if (hasRareData()) {
+ ElementRareData* data = ""
+ if (data->needsFocusAppearanceUpdateSoonAfterAttach()) {
+ if (isFocusable() && document()->focusedNode() == this)
+ document()->updateFocusAppearanceSoon(false /* don't restore selection */);
+ data->setNeedsFocusAppearanceUpdateSoonAfterAttach(false);
+ }
}
}
-
resumePostAttachCallbacks();
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
