Title: [135914] trunk
- Revision
- 135914
- Author
- tse...@chromium.org
- Date
- 2012-11-27 13:50:15 -0800 (Tue, 27 Nov 2012)
Log Message
Regression(r129406): Fix the scope of the WidgetHierarchyUpdateSuspensionScope in Element::Attach().
https://bugs.webkit.org/show_bug.cgi?id=100803
Reviewed by Abhishek Arya.
Source/WebCore:
Ensures that the suspension scope has gone out of scope before calling into
resumePostAttachCallbacks().
Test: fast/dom/adopt-node-crash-2.html
* dom/Element.cpp:
(WebCore::Element::attach):
LayoutTests:
* fast/dom/adopt-node-crash-2-expected.txt: Added.
* fast/dom/adopt-node-crash-2.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (135913 => 135914)
--- trunk/LayoutTests/ChangeLog 2012-11-27 21:39:15 UTC (rev 135913)
+++ trunk/LayoutTests/ChangeLog 2012-11-27 21:50:15 UTC (rev 135914)
@@ -1,3 +1,13 @@
+2012-11-27 Tom Sepez <tse...@chromium.org>
+
+ Regression(r129406): Fix the scope of the WidgetHierarchyUpdateSuspensionScope in Element::Attach().
+ https://bugs.webkit.org/show_bug.cgi?id=100803
+
+ Reviewed by Abhishek Arya.
+
+ * fast/dom/adopt-node-crash-2-expected.txt: Added.
+ * fast/dom/adopt-node-crash-2.html: Added.
+
2012-11-27 Tony Chang <t...@chromium.org>
Remove hidden limiter div in the input slider shadow DOM
Added: trunk/LayoutTests/fast/dom/adopt-node-crash-2-expected.txt (0 => 135914)
--- trunk/LayoutTests/fast/dom/adopt-node-crash-2-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/adopt-node-crash-2-expected.txt 2012-11-27 21:50:15 UTC (rev 135914)
@@ -0,0 +1,2 @@
+Tests for a crash due to adopting a DOM node during DOMFocusOut event. Test passes if it doesn't crash.
+
Added: trunk/LayoutTests/fast/dom/adopt-node-crash-2.html (0 => 135914)
--- trunk/LayoutTests/fast/dom/adopt-node-crash-2.html (rev 0)
+++ trunk/LayoutTests/fast/dom/adopt-node-crash-2.html 2012-11-27 21:50:15 UTC (rev 135914)
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<div>Tests for a crash due to adopting a DOM node during DOMFocusOut event. Test passes if it doesn't crash.</div>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+</script>
+<div id="div1"></div>
+<div id="div2">
+ <applet>
+ <iframe srcdoc="<iframe srcdoc=''>">
+ </iframe>
+ </applet>
+ <header id="header1">
+ <keygen autofocus>
+ </header>
+</div>
+<script>
+function doit()
+{
+ div2.addEventListener("DOMFocusOut", function () { document.implementation.createDocument("", "", null).adoptNode(div2); }, false);
+ div1.outerHTML = header1.outerHTML;
+ if (window.testRunner)
+ testRunner.notifyDone();
+}
+document.addEventListener("DOMContentLoaded", setTimeout("doit()", 1), false);
+</script>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (135913 => 135914)
--- trunk/Source/WebCore/ChangeLog 2012-11-27 21:39:15 UTC (rev 135913)
+++ trunk/Source/WebCore/ChangeLog 2012-11-27 21:50:15 UTC (rev 135914)
@@ -1,3 +1,18 @@
+2012-11-27 Tom Sepez <tse...@chromium.org>
+
+ Regression(r129406): Fix the scope of the WidgetHierarchyUpdateSuspensionScope in Element::Attach().
+ https://bugs.webkit.org/show_bug.cgi?id=100803
+
+ Reviewed by Abhishek Arya.
+
+ Ensures that the suspension scope has gone out of scope before calling into
+ resumePostAttachCallbacks().
+
+ Test: fast/dom/adopt-node-crash-2.html
+
+ * dom/Element.cpp:
+ (WebCore::Element::attach):
+
2012-11-27 Tony Chang <t...@chromium.org>
Remove hidden limiter div in the input slider shadow DOM
Modified: trunk/Source/WebCore/dom/Element.cpp (135913 => 135914)
--- trunk/Source/WebCore/dom/Element.cpp 2012-11-27 21:39:15 UTC (rev 135913)
+++ trunk/Source/WebCore/dom/Element.cpp 2012-11-27 21:50:15 UTC (rev 135914)
@@ -1198,34 +1198,34 @@
void Element::attach()
{
suspendPostAttachCallbacks();
- WidgetHierarchyUpdatesSuspensionScope suspendWidgetHierarchyUpdates;
+ {
+ WidgetHierarchyUpdatesSuspensionScope suspendWidgetHierarchyUpdates;
+ createRendererIfNeeded();
- createRendererIfNeeded();
+ StyleResolverParentPusher parentPusher(this);
- StyleResolverParentPusher parentPusher(this);
+ if (parentElement() && parentElement()->isInCanvasSubtree())
+ setIsInCanvasSubtree(true);
- if (parentElement() && parentElement()->isInCanvasSubtree())
- setIsInCanvasSubtree(true);
-
- // When a shadow root exists, it does the work of attaching the children.
- if (ElementShadow* shadow = this->shadow()) {
- parentPusher.push();
- shadow->attach();
- } else {
- if (firstChild())
+ // When a shadow root exists, it does the work of attaching the children.
+ if (ElementShadow* shadow = this->shadow()) {
parentPusher.push();
- }
- ContainerNode::attach();
+ shadow->attach();
+ } else {
+ if (firstChild())
+ parentPusher.push();
+ }
+ ContainerNode::attach();
- if (hasRareData()) {
- ElementRareData* data = ""
- if (data->needsFocusAppearanceUpdateSoonAfterAttach()) {
- if (isFocusable() && document()->focusedNode() == this)
- document()->updateFocusAppearanceSoon(false /* don't restore selection */);
- data->setNeedsFocusAppearanceUpdateSoonAfterAttach(false);
+ if (hasRareData()) {
+ ElementRareData* data = ""
+ if (data->needsFocusAppearanceUpdateSoonAfterAttach()) {
+ if (isFocusable() && document()->focusedNode() == this)
+ document()->updateFocusAppearanceSoon(false /* don't restore selection */);
+ data->setNeedsFocusAppearanceUpdateSoonAfterAttach(false);
+ }
}
}
-
resumePostAttachCallbacks();
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes
