[webkit-changes] [88832] branches/chromium/782

[cevans]

Title: [88832] branches/chromium/782

Revision

88832

Author

cev...@google.com

Date

2011-06-14 11:26:50 -0700 (Tue, 14 Jun 2011)

Log Message

Merge 88434
BUG=85102
Review URL: http://codereview.chromium.org/7150019

Modified Paths

branches/chromium/782/Source/WebCore/html/parser/HTMLConstructionSite.cpp


Added Paths

branches/chromium/782/LayoutTests/fast/parser/document-write-onload-clear-expected.txt
branches/chromium/782/LayoutTests/fast/parser/document-write-onload-clear.html

Diff

Copied: branches/chromium/782/LayoutTests/fast/parser/document-write-onload-clear-expected.txt (from rev 88434, trunk/LayoutTests/fast/parser/document-write-onload-clear-expected.txt) (0 => 88832)

--- branches/chromium/782/LayoutTests/fast/parser/document-write-onload-clear-expected.txt	                        (rev 0)
+++ branches/chromium/782/LayoutTests/fast/parser/document-write-onload-clear-expected.txt	2011-06-14 18:26:50 UTC (rev 88832)
@@ -0,0 +1,2 @@
+PASS
+

Copied: branches/chromium/782/LayoutTests/fast/parser/document-write-onload-clear.html (from rev 88434, trunk/LayoutTests/fast/parser/document-write-onload-clear.html) (0 => 88832)

--- branches/chromium/782/LayoutTests/fast/parser/document-write-onload-clear.html	                        (rev 0)
+++ branches/chromium/782/LayoutTests/fast/parser/document-write-onload-clear.html	2011-06-14 18:26:50 UTC (rev 88832)
@@ -0,0 +1,5 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<iframe _onload_="document.write('<p>FAIL<iframe _onload_=&quot;document.write(\'<p>\')&quot;></iframe><script>document.body.innerHTML = \'PASS\';</script>');document.close();"></iframe>

Modified: branches/chromium/782/Source/WebCore/html/parser/HTMLConstructionSite.cpp (88831 => 88832)

--- branches/chromium/782/Source/WebCore/html/parser/HTMLConstructionSite.cpp	2011-06-14 18:25:30 UTC (rev 88831)
+++ branches/chromium/782/Source/WebCore/html/parser/HTMLConstructionSite.cpp	2011-06-14 18:26:50 UTC (rev 88832)
@@ -82,13 +82,14 @@
 } // namespace
 
 template<typename ChildType>
-PassRefPtr<ChildType> HTMLConstructionSite::attach(ContainerNode* parent, PassRefPtr<ChildType> prpChild)
+PassRefPtr<ChildType> HTMLConstructionSite::attach(ContainerNode* rawParent, PassRefPtr<ChildType> prpChild)
 {
     RefPtr<ChildType> child = prpChild;
+    RefPtr<ContainerNode> parent = rawParent;
 
     // FIXME: It's confusing that HTMLConstructionSite::attach does the magic
     // redirection to the foster parent but HTMLConstructionSite::attachAtSite
-    // doesn't.  It feels like we're missing a concept somehow.
+    // doesn't. It feels like we're missing a concept somehow.
     if (shouldFosterParent()) {
         fosterParent(child.get());
         ASSERT(child->attached() || !child->parentNode() || !child->parentNode()->attached());
@@ -102,11 +103,6 @@
     if (!child->parentNode())
         return child.release();
 
-    // It's slightly unfortunate that we need to hold a reference to child
-    // here to call attach().  We should investigate whether we can rely on
-    // |parent| to hold a ref at this point.  In the common case (at least
-    // for elements), however, we'll get to use this ref in the stack of
-    // open elements.
     if (parent->attached() && !child->attached())
         child->attach();
     return child.release();

_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes