Title: [141146] branches/chromium/1364
- Revision
- 141146
- Author
- [email protected]
- Date
- 2013-01-29 12:51:20 -0800 (Tue, 29 Jan 2013)
Log Message
Merge 139806
BUG=168489
Review URL: https://codereview.chromium.org/12087060
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1364/LayoutTests/accessibility/crash-adopt-node-from-new-document-expected.txt (from rev 139806, trunk/LayoutTests/accessibility/crash-adopt-node-from-new-document-expected.txt) (0 => 141146)
--- branches/chromium/1364/LayoutTests/accessibility/crash-adopt-node-from-new-document-expected.txt (rev 0)
+++ branches/chromium/1364/LayoutTests/accessibility/crash-adopt-node-from-new-document-expected.txt 2013-01-29 20:51:20 UTC (rev 141146)
@@ -0,0 +1,2 @@
+ALERT: This test makes sure that adopting a node with an AccessibilityObject into a new document doesn't crash. Test passed.
+
Copied: branches/chromium/1364/LayoutTests/accessibility/crash-adopt-node-from-new-document.html (from rev 139806, trunk/LayoutTests/accessibility/crash-adopt-node-from-new-document.html) (0 => 141146)
--- branches/chromium/1364/LayoutTests/accessibility/crash-adopt-node-from-new-document.html (rev 0)
+++ branches/chromium/1364/LayoutTests/accessibility/crash-adopt-node-from-new-document.html 2013-01-29 20:51:20 UTC (rev 141146)
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+
+<canvas>
+<div id="node1">
+<div id="node2">
+</canvas>
+
+<script>
+document.getElementById("node2").setAttribute("aria-label", "Label");
+document.implementation.createDocument("", "", null).adoptNode(node1);
+
+gc();
+
+alert("This test makes sure that adopting a node with an AccessibilityObject into a new document doesn't crash. Test passed.");
+
+</script>
+<script src=""
+</body>
+</html>
Modified: branches/chromium/1364/Source/WebCore/dom/Node.cpp (141145 => 141146)
--- branches/chromium/1364/Source/WebCore/dom/Node.cpp 2013-01-29 20:48:15 UTC (rev 141145)
+++ branches/chromium/1364/Source/WebCore/dom/Node.cpp 2013-01-29 20:51:20 UTC (rev 141146)
@@ -2099,6 +2099,9 @@
{
TreeScopeAdopter::ensureDidMoveToNewDocumentWasCalled(oldDocument);
+ if (AXObjectCache::accessibilityEnabled() && oldDocument && oldDocument->axObjectCacheExists())
+ oldDocument->axObjectCache()->remove(this);
+
// FIXME: Event listener types for this node should be set on the new owner document here.
const EventListenerVector& wheelListeners = getEventListeners(eventNames().mousewheelEvent);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
