Title: [139657] branches/chromium/1364
- Revision
- 139657
- Author
- [email protected]
- Date
- 2013-01-14 13:37:59 -0800 (Mon, 14 Jan 2013)
Log Message
Merge 139100
BUG=167780
Review URL: https://codereview.chromium.org/11879024
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1364/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash-expected.txt (from rev 139100, trunk/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash-expected.txt) (0 => 139657)
--- branches/chromium/1364/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash-expected.txt (rev 0)
+++ branches/chromium/1364/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash-expected.txt 2013-01-14 21:37:59 UTC (rev 139657)
@@ -0,0 +1,4 @@
+PASS successfullyParsed is true
+
+TEST COMPLETE
+PASS, assuming we didn't crash.
Copied: branches/chromium/1364/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html (from rev 139100, trunk/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html) (0 => 139657)
--- branches/chromium/1364/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html (rev 0)
+++ branches/chromium/1364/LayoutTests/fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html 2013-01-14 21:37:59 UTC (rev 139657)
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html>
+<head id=head1 style="border-right-color: inherit;">
+<style>
+*[foo^=""] { border: inherit; }
+</style>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+if (window.testRunner) {
+ testRunner.dumpAsText();
+}
+
+function handleSubtreeModifiedEvent() {
+ document.open();
+ document.write("FAIL. WebKit shouldn't dispatch a DOMSubtreeModified event when element inline style is modified through CSSOM.");
+ document.close();
+ finishJSTest();
+}
+
+function everythingWentBetterThanExpected() {
+ document.open();
+ document.write("PASS, assuming we didn't crash.");
+ document.close();
+ finishJSTest();
+}
+
+function load() {
+ head1.attributes[1].addEventListener("DOMSubtreeModified", handleSubtreeModifiedEvent, false);
+ head1.style.display = "none";
+ setTimeout("everythingWentBetterThanExpected()", 0);
+}
+
+document.addEventListener("DOMContentLoaded", load, false);
+</script>
+<body>
+<script src=""
+</body>
+</html>
Modified: branches/chromium/1364/Source/WebCore/dom/Document.cpp (139656 => 139657)
--- branches/chromium/1364/Source/WebCore/dom/Document.cpp 2013-01-14 21:31:58 UTC (rev 139656)
+++ branches/chromium/1364/Source/WebCore/dom/Document.cpp 2013-01-14 21:37:59 UTC (rev 139657)
@@ -4467,6 +4467,7 @@
void Document::styleResolverThrowawayTimerFired(Timer<Document>*)
{
+ ASSERT(!m_inStyleRecalc);
clearStyleResolver();
}
Modified: branches/chromium/1364/Source/WebCore/dom/Element.cpp (139656 => 139657)
--- branches/chromium/1364/Source/WebCore/dom/Element.cpp 2013-01-14 21:31:58 UTC (rev 139656)
+++ branches/chromium/1364/Source/WebCore/dom/Element.cpp 2013-01-14 21:37:59 UTC (rev 139657)
@@ -739,7 +739,7 @@
// If there is an Attr node hooked to this attribute, the Attr::setValue() call below
// will write into the ElementAttributeData.
// FIXME: Refactor this so it makes some sense.
- if (RefPtr<Attr> attrNode = attrIfExists(name))
+ if (RefPtr<Attr> attrNode = inSynchronizationOfLazyAttribute ? 0 : attrIfExists(name))
attrNode->setValue(newValue);
else
mutableAttributeData()->attributeItem(index)->setValue(newValue);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
