Title: [119640] branches/chromium/1132
- Revision
- 119640
- Author
- [email protected]
- Date
- 2012-06-06 17:06:14 -0700 (Wed, 06 Jun 2012)
Log Message
Merge 119050
BUG=130235
Review URL: https://chromiumcodereview.appspot.com/10539032
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1132/LayoutTests/fast/dom/child-insertion-notify-crash-expected.txt (from rev 119050, trunk/LayoutTests/fast/dom/child-insertion-notify-crash-expected.txt) (0 => 119640)
--- branches/chromium/1132/LayoutTests/fast/dom/child-insertion-notify-crash-expected.txt (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/dom/child-insertion-notify-crash-expected.txt 2012-06-07 00:06:14 UTC (rev 119640)
@@ -0,0 +1,4 @@
+PASS successfullyParsed is true
+
+TEST COMPLETE
+PASS. WebKit didn't crash.
Copied: branches/chromium/1132/LayoutTests/fast/dom/child-insertion-notify-crash.html (from rev 119050, trunk/LayoutTests/fast/dom/child-insertion-notify-crash.html) (0 => 119640)
--- branches/chromium/1132/LayoutTests/fast/dom/child-insertion-notify-crash.html (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/dom/child-insertion-notify-crash.html 2012-06-07 00:06:14 UTC (rev 119640)
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<script src=""
+<script>
+function crash()
+{
+ document.getElementById("test").innerHTML = "PASS. WebKit didn't crash.";
+ gc();
+}
+</script>
+<div dir="auto" id="test">A<iframe _onload_="crash()"></iframe></div>
+<script src=""
+</html>
+
Modified: branches/chromium/1132/Source/WebCore/dom/ContainerNode.cpp (119639 => 119640)
--- branches/chromium/1132/Source/WebCore/dom/ContainerNode.cpp 2012-06-07 00:03:49 UTC (rev 119639)
+++ branches/chromium/1132/Source/WebCore/dom/ContainerNode.cpp 2012-06-07 00:06:14 UTC (rev 119640)
@@ -593,10 +593,8 @@
allowEventDispatch();
- // FIXME: Why doesn't this use notify(newChild.get()) instead?
- if (inDocument())
- ChildNodeInsertionNotifier(this).notifyInsertedIntoDocument(newChild.get());
childrenChanged(true, last, 0, 1);
+ ChildNodeInsertionNotifier(this).notify(newChild.get());
}
void ContainerNode::suspendPostAttachCallbacks()
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
