[SCM] WebKit Debian packaging branch, webkit-1.1, updated. upstream/1.1.15.1-34-g43a6bb2

Gustavo Noronha Silva gustavo.noronha at collabora.co.uk
Wed Oct 7 06:26:01 UTC 2009


The following commit has been merged in the webkit-1.1 branch:
commit 52723869f4014b72c5e32c893b3078702d74f775
Author: darin at apple.com <darin at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Fri Sep 25 21:08:17 2009 +0000

    Null-deref when first access to an Attr node is after its Element is destroyed
    https://bugs.webkit.org/show_bug.cgi?id=29748
    
    Patch by Darin Adler <darin at apple.com> on 2009-09-25
    Reviewed by Geoffrey Garen.
    
    WebCore:
    
    Test: fast/dom/Attr/access-after-element-destruction.html
    
    * bindings/js/JSAttrCustom.cpp:
    (WebCore::JSAttr::markChildren): Added. Keeps the ownerElement alive as
    long as the Attr is alive.
    
    * bindings/js/JSNamedNodeMapCustom.cpp:
    (WebCore::JSNamedNodeMap::markChildren): Added. Keeps the Element alive as
    long as the NamedNodeMap is alive.
    
    * dom/Attr.idl: Added CustomMarkFunction attribute.
    
    * dom/NamedAttrMap.cpp:
    (WebCore::NamedNodeMap::getAttributeItem): Tweaked formatting.
    (WebCore::NamedNodeMap::detachFromElement): Call clearAttributes so we don't
    have attributes hanging around that might need an Attr node created; that way
    we won't crash with a null-dereference trying to deal with one of them. This
    can't happen when working with JavaScript since the Element will be kept
    alive due to the change above.
    (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
    (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "+ 1" and added
    missing braces.
    
    * dom/NamedAttrMap.h: Made the element function public so it can be used by
    the JavaScript binding to keep the Element alive.
    
    * dom/NamedNodeMap.idl: Added CustomMarkFunction attribute.
    
    LayoutTests:
    
    * fast/dom/Attr/access-after-element-destruction-expected.txt: Added.
    * fast/dom/Attr/access-after-element-destruction.html: Added.
    * fast/dom/Attr/script-tests/TEMPLATE.html: Copied from LayoutTests/fast/dom/Node/script-tests/TEMPLATE.html.
    * fast/dom/Attr/script-tests/access-after-element-destruction.js: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48769 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 6356ee0..c7b6448 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,94 +1,3 @@
-2009-09-27  Sam Weinig  <sam at webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Tests for https://bugs.webkit.org/show_bug.cgi?id=29760
-        Implement CSSOM Range.getClientRects/getBoundingClientRect 
-
-        * fast/dom/Element/getBoundingClientRect-expected.txt: Copied from LayoutTests/fast/dom/getBoundingClientRect-expected.txt.
-        * fast/dom/Element/getBoundingClientRect-getClientRects-relative-to-viewport-expected.txt: Copied from LayoutTests/fast/dom/getBoundingClientRect-getClientRects-relative-to-viewport-expected.txt.
-        * fast/dom/Element/getBoundingClientRect-getClientRects-relative-to-viewport.html: Copied from LayoutTests/fast/dom/getBoundingClientRect-getClientRects-relative-to-viewport.html.
-        * fast/dom/Element/getBoundingClientRect.html: Copied from LayoutTests/fast/dom/getBoundingClientRect.html.
-        * fast/dom/Element/getClientRects-expected.txt: Copied from LayoutTests/fast/dom/getClientRects-expected.txt.
-        * fast/dom/Element/getClientRects.html: Copied from LayoutTests/fast/dom/getClientRects.html.
-        * fast/dom/Range/getBoundingClientRect-expected.txt: Added.
-        * fast/dom/Range/getBoundingClientRect-getClientRects-relative-to-viewport-expected.txt: Added.
-        * fast/dom/Range/getBoundingClientRect-getClientRects-relative-to-viewport.html: Added.
-        * fast/dom/Range/getBoundingClientRect.html: Added.
-        * fast/dom/Range/getClientRects-expected.txt: Added.
-        * fast/dom/Range/getClientRects.html: Added.
-        * fast/dom/Window/window-properties-expected.txt:
-        * fast/dom/getBoundingClientRect-expected.txt: Removed.
-        * fast/dom/getBoundingClientRect-getClientRects-relative-to-viewport-expected.txt: Removed.
-        * fast/dom/getBoundingClientRect-getClientRects-relative-to-viewport.html: Removed.
-        * fast/dom/getBoundingClientRect.html: Removed.
-        * fast/dom/getClientRects-expected.txt: Removed.
-        * fast/dom/getClientRects.html: Removed.
-
-2009-09-27  Jakub Wieczorek  <faw217 at gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Remove tests that are passing from the Skipped list after implementing
-        the waitForPolicyDelegate() function in LayoutTestController.
-        https://bugs.webkit.org/show_bug.cgi?id=25037
-
-        * platform/qt/Skipped:
-
-2009-09-25  Adam Barth  <abarth at webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Load blocks during unload should not affect targeted loads
-        https://bugs.webkit.org/show_bug.cgi?id=29747
-
-        Test that we can follow targeted hyperlinks in an unload handler.
-
-        * fast/loader/resources/unload-hyperlink-targeted-subframe.html: Added.
-        * fast/loader/unload-hyperlink-targeted-expected.txt: Added.
-        * fast/loader/unload-hyperlink-targeted.html: Added.
-
-2009-09-25  Alexey Proskuryakov  <ap at apple.com>
-
-        Reverting r48767, as it broke Windows build in a non-trivial way.
-
-        * fast/events/attribute-listener-cloned-from-frameless-doc-context-2-expected.txt: Removed.
-        * fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html: Removed.
-        * fast/events/attribute-listener-cloned-from-frameless-doc-context-expected.txt: Removed.
-        * fast/events/attribute-listener-cloned-from-frameless-doc-context.html: Removed.
-        * fast/events/attribute-listener-cloned-from-frameless-doc-expected.txt: Removed.
-        * fast/events/attribute-listener-cloned-from-frameless-doc.xhtml: Removed.
-        * fast/events/attribute-listener-extracted-from-frameless-doc-context-2-expected.txt: Removed.
-        * fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html: Removed.
-        * fast/events/attribute-listener-extracted-from-frameless-doc-context-expected.txt: Removed.
-        * fast/events/attribute-listener-extracted-from-frameless-doc-context.html: Removed.
-
-2009-09-25  Simon Fraser  <simon.fraser at apple.com>
-
-        Reviewed by Darin Adler.
-
-        Crash with hardware accelerated rotation of a PDF image in a data URL
-        <rdar://problem/7250378>
-        
-        Testcase for a PDF image as the contents of a compositing layer.
-
-        * compositing/color-matching/pdf-image-match.html: Added.
-        * platform/mac/compositing/color-matching/pdf-image-match-expected.checksum: Added.
-        * platform/mac/compositing/color-matching/pdf-image-match-expected.png: Added.
-        * platform/mac/compositing/color-matching/pdf-image-match-expected.txt: Added.
-
-2009-09-25  Darin Adler  <darin at apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Null-deref when first access to an Attr node is after its Element is destroyed
-        https://bugs.webkit.org/show_bug.cgi?id=29748
-
-        * fast/dom/Attr/access-after-element-destruction-expected.txt: Added.
-        * fast/dom/Attr/access-after-element-destruction.html: Added.
-        * fast/dom/Attr/script-tests/TEMPLATE.html: Copied from LayoutTests/fast/dom/Node/script-tests/TEMPLATE.html.
-        * fast/dom/Attr/script-tests/access-after-element-destruction.js: Added.
-
 2009-09-24  Alexey Proskuryakov  <ap at apple.com>
 
         Reviewed by Darin Adler and Sam Weinig.
diff --git a/LayoutTests/fast/dom/Attr/access-after-element-destruction-expected.txt b/LayoutTests/fast/dom/Attr/access-after-element-destruction-expected.txt
new file mode 100644
index 0000000..8c09132
--- /dev/null
+++ b/LayoutTests/fast/dom/Attr/access-after-element-destruction-expected.txt
@@ -0,0 +1,25 @@
+Tests that accessing Attr after its Element has been destroyed works without crashing.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS attributes.length is 1
+PASS attributes[0] is attributes.item(0)
+PASS attributes.getNamedItem('a') is attributes.item(0)
+PASS attributes.item(0).name is 'a'
+PASS attributes.item(0).specified is true
+PASS attributes.item(0).value is 'b'
+PASS attributes.item(0).ownerElement.tagName is 'P'
+PASS attributes.item(0).style is null
+PASS attributes.item(0).value is 'c'
+PASS attributes.length is 0
+PASS attr.name is 'a'
+PASS attr.specified is true
+PASS attr.value is 'b'
+PASS attr.ownerElement.tagName is 'P'
+PASS attr.style is null
+PASS attr.value is 'c'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/dom/Attr/access-after-element-destruction.html b/LayoutTests/fast/dom/Attr/access-after-element-destruction.html
new file mode 100644
index 0000000..39e014d
--- /dev/null
+++ b/LayoutTests/fast/dom/Attr/access-after-element-destruction.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css">
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/access-after-element-destruction.js"></script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/css/getComputedStyle/script-tests/TEMPLATE.html b/LayoutTests/fast/dom/Attr/script-tests/TEMPLATE.html
similarity index 100%
copy from LayoutTests/fast/css/getComputedStyle/script-tests/TEMPLATE.html
copy to LayoutTests/fast/dom/Attr/script-tests/TEMPLATE.html
diff --git a/LayoutTests/fast/dom/Attr/script-tests/access-after-element-destruction.js b/LayoutTests/fast/dom/Attr/script-tests/access-after-element-destruction.js
new file mode 100644
index 0000000..91588a3
--- /dev/null
+++ b/LayoutTests/fast/dom/Attr/script-tests/access-after-element-destruction.js
@@ -0,0 +1,55 @@
+description("Tests that accessing Attr after its Element has been destroyed works without crashing.");
+
+function gc()
+{
+    if (window.GCController)
+        return GCController.collect();
+
+    // Trigger garbage collection indirectly.
+    for (var i = 0; i < 100000; i++)
+        new String(i);
+}
+
+var element = document.createElement("p");
+element.setAttribute("a", "b");
+var attributes = element.attributes;
+element = null;
+
+gc();
+
+shouldBe("attributes.length", "1");
+shouldBe("attributes[0]", "attributes.item(0)");
+shouldBe("attributes.getNamedItem('a')", "attributes.item(0)");
+
+shouldBe("attributes.item(0).name", "'a'");
+shouldBe("attributes.item(0).specified", "true");
+shouldBe("attributes.item(0).value", "'b'");
+shouldBe("attributes.item(0).ownerElement.tagName", "'P'");
+shouldBe("attributes.item(0).style", "null");
+
+attributes.item(0).value = 'c';
+
+shouldBe("attributes.item(0).value", "'c'");
+
+attributes.removeNamedItem('a');
+
+shouldBe("attributes.length", "0");
+
+element = document.createElement("p");
+element.setAttribute("a", "b");
+var attr = element.attributes.item(0);
+element = null;
+
+gc();
+
+shouldBe("attr.name", "'a'");
+shouldBe("attr.specified", "true");
+shouldBe("attr.value", "'b'");
+shouldBe("attr.ownerElement.tagName", "'P'");
+shouldBe("attr.style", "null");
+
+attr.value = 'c';
+
+shouldBe("attr.value", "'c'");
+
+var successfullyParsed = true;
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 3098fbb..e8b7432 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,619 +1,3 @@
-2009-09-28  Joseph Pecoraro  <joepeck at webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector Should Show Event Listeners/Handlers Registered on each Node
-        https://bugs.webkit.org/show_bug.cgi?id=17429
-        
-          Extracted a method from dispatchEvent to get the event ancestor chain
-        
-        * dom/Node.cpp:
-        (WebCore::Node::eventAncestors): the extracted method
-        (WebCore::Node::dispatchGenericEvent): use eventAncestors
-        * dom/Node.h:
-
-          Asynchronous Flow For the Inspector, Backend -> DOM Agent -> Frontend
-          The DOMAgent's getEventListenersForNode handles the logic of finding
-          all the relevant listeners in the event flow.
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getEventListenersForNode):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::getEventListenersForNode):
-        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
-        (WebCore::InspectorDOMAgent::buildObjectForNode): added localName
-        * inspector/InspectorDOMAgent.h:
-        (WebCore::EventListenerInfo::EventListenerInfo):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::didGetEventListenersForNode):
-        * inspector/InspectorFrontend.h:
-        (WebCore::InspectorFrontend::scriptState):
-        * inspector/front-end/DOMAgent.js: added localName to WebInspector.DOMNode from payload
-        (WebInspector.EventListeners.getEventListenersForNodeAsync.mycallback):
-        (WebInspector.EventListeners.getEventListenersForNodeAsync):
-
-          New Sidebar Pane in the Element's Panel
-          Includes Gear Menu for filtering the Event Listeners on the
-          "Selected Node Only" or "All Nodes"
-
-        * inspector/front-end/ElementsPanel.js: Handles refreshing the Pane when necessary
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-        (WebInspector.ElementsPanel):
-        (WebInspector.ElementsPanel.prototype.updateEventListeners):
-        * inspector/front-end/EventListenersSidebarPane.js: Added. 
-        (WebInspector.EventListenersSidebarPane): The 1st level in the Pane
-        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
-        (WebInspector.EventListenersSidebarPane.prototype.update):
-        (WebInspector.EventListenersSection): The 2nd level in the Pane
-        (WebInspector.EventListenersSection.prototype.update): filters on Preference
-        (WebInspector.EventListenersSection.prototype.addListener):
-        (WebInspector.EventListenerBar): The 3rd level in the Pane
-        (WebInspector.EventListenerBar.prototype._getNodeDisplayName):
-        (WebInspector.EventListenerBar.prototype._getFunctionDisplayName):
-        (WebInspector.EventListenersSidebarPane.prototype._changeSetting): For the Gear Menu
-        
-          Consolidated "appropriateSelectorForNode"
-
-        * inspector/front-end/StylesSidebarPane.js:
-        * inspector/front-end/utilities.js:
-
-          Miscellaneous Updates
-
-        * English.lproj/localizedStrings.js: "Event Listeners", "No Event Listeners", "Selected Node Only", "All Nodes"
-        * WebCore.gypi: included the new inspector files
-        * WebCore.vcproj/WebCore.vcproj: included source files that were missing
-        * inspector/front-end/Images/grayConnectorPoint.png: Added. Thanks to Timothy Hatcher.
-        * inspector/front-end/Images/whiteConnectorPoint.png: Added. Thanks to Timothy Hatcher.
-        * inspector/front-end/inspector.js: Preferences for the Gear Menu Event Listeners filter
-        * inspector/front-end/inspector.css: reused as much as possible
-        * inspector/front-end/inspector.html: include the new script
-        * inspector/front-end/WebKit.qrc: included the new inspector files
-
-2009-09-27  Sam Weinig  <sam at webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29760
-        Implement CSSOM Range.getClientRects/getBoundingClientRect 
-
-        Tests: fast/dom/Range/getBoundingClientRect-getClientRects-relative-to-viewport.html
-               fast/dom/Range/getBoundingClientRect.html
-               fast/dom/Range/getClientRects.html
-
-        * dom/Range.cpp:
-        (WebCore::Range::getClientRects):
-        (WebCore::Range::getBoundingClientRect):
-        (WebCore::adjustFloatQuadsForScrollAndAbsoluteZoom):
-        (WebCore::Range::getBorderAndTextQuads):
-        * dom/Range.h:
-        * dom/Range.idl:
-        Implement Range.getClientRects/getBoundingClientRect.
-
-        * dom/Element.cpp:
-        * rendering/RenderObject.h: 
-        (WebCore::adjustForAbsoluteZoom):
-        (WebCore::adjustIntRectForAbsoluteZoom):
-        (WebCore::adjustFloatPointForAbsoluteZoom):
-        (WebCore::adjustFloatQuadForAbsoluteZoom):
-        Move point/quad adjustment methods from Element.cpp to RenderObject.h
-        so that Range.cpp can use them as well.
-
-2009-09-27  Simon Hausmann  <hausmann at webkit.org>
-
-        Unreviewed fix for WebInspector with Qt build.
-
-        Simply re-generate the Qt resource file by running
-        WebKitTools/Scripts/generate-qt-inspector-resource
-
-        * inspector/front-end/WebKit.qrc:
-
-2009-09-27  Pavel Feldman  <pfeldman at chromium.org>
-
-        Reviewed by nobody (trivial ChangeLog fix).
-
-        Restore WebCore/ChangeLog truncated in r48778.
-
-2009-09-27  Pavel Feldman  <pfeldman at chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: DOM store is being unbound twice, leading to assertion failure.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29770
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didOpenDatabase):
-        (WebCore::InspectorController::didUseDOMStorage):
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::unbind):
-
-2009-09-26  Pavel Feldman  <pfeldman at chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Do not track DOM changes while inspector window is closed.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29769
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::resetScriptObjects):
-        (WebCore::InspectorController::didCommitLoad):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::setDocument):
-        * inspector/InspectorDOMAgent.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
-        * page/android/InspectorControllerAndroid.cpp:
-        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
-
-2009-09-26  Pavel Feldman  <pfeldman at chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: [REGRESSION] Double Clicking Resources Fails to Open in New Window
-
-        https://bugs.webkit.org/show_bug.cgi?id=29762
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.setStyleText):
-        (InjectedScript.openInInspectedWindow):
-        * inspector/front-end/InjectedScriptAccess.js:
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
-
-2009-09-26  David Kilzer  <ddkilzer at apple.com>
-
-        Part 2 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
-
-        Reviewed by Darin Adler.
-
-        Fix ENABLE_ORIENTATION_EVENTS for non-Mac platforms.
-
-        * DerivedSources.make: Moved Platform.h check for
-        ENABLE_ORIENTATION_EVENTS into Mac-only section and added
-        default of ENABLE_ORIENTATION_EVENTS = 0 to non-Mac section.
-        Added ifndef test to make it possible to override both
-        ENABLE_DASHBOARD_SUPPORT and ENABLE_ORIENTATION_EVENTS external
-        to the makefile.  Moved addition of ENABLE_ORIENTATION_EVENTS to
-        ADDITIONAL_IDL_DEFINES to common section.
-        * GNUmakefile.am: Added support for ENABLE_ORIENTATION_EVENTS if
-        it is ever used.
-        * WebCore.pro: Ditto.
-
-2009-09-26  Kent Tamura  <tkent at chromium.org>
-
-        Reviewed by David Kilzer.
-
-        Move placeholder-related code to HTMLTextFormControlElement from
-        HTMLInputElement, WMLInputElement, InputElement, and
-        HTMLTextAreaElement.
-        https://bugs.webkit.org/show_bug.cgi?id=28703
-
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::dispatchFocusEvent):
-        (WebCore::InputElement::dispatchBlurEvent):
-        (WebCore::InputElement::setValueFromRenderer):
-        * dom/InputElement.h:
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLTextFormControlElement::HTMLTextFormControlElement):
-        (WebCore::HTMLTextFormControlElement::~HTMLTextFormControlElement):
-        (WebCore::HTMLTextFormControlElement::dispatchFocusEvent):
-        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent):
-        (WebCore::HTMLTextFormControlElement::placeholderShouldBeVisible):
-        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLTextFormControlElement::handleFocusEvent):
-        (WebCore::HTMLTextFormControlElement::handleBlurEvent):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::HTMLInputElement):
-        (WebCore::HTMLInputElement::handleFocusEvent):
-        (WebCore::HTMLInputElement::handleBlurEvent):
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        (WebCore::HTMLInputElement::createRenderer):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::setValueFromRenderer):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::supportsPlaceholder):
-        (WebCore::HTMLInputElement::isEmptyValue):
-        * html/HTMLIsIndexElement.cpp:
-        (WebCore::HTMLIsIndexElement::parseMappedAttribute):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
-        (WebCore::HTMLTextAreaElement::createRenderer):
-        * html/HTMLTextAreaElement.h:
-        (WebCore::HTMLTextAreaElement::supportsPlaceholder):
-        (WebCore::HTMLTextAreaElement::isEmptyValue):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::RenderTextControl):
-        * rendering/RenderTextControl.h:
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
-        * rendering/RenderTextControlMultiLine.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
-        (WebCore::RenderTextControlSingleLine::updateFromElement):
-        * rendering/RenderTextControlSingleLine.h:
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::setValue):
-        (WebCore::WMLInputElement::createRenderer):
-        * wml/WMLInputElement.h:
-
-2009-09-26  Shu Chang  <Chang.Shu at nokia.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Optimize the code so only the text from start to end is scanned.
-        https://bugs.webkit.org/show_bug.cgi?id=29092
-
-        On a platform with webkit+Qt+Symbian, the parsing time for a 600K text
-        file improved from 400ms to 40ms (10x faster).
-
-        * dom/Text.cpp:
-        (WebCore::Text::createWithLengthLimit):
-
-2009-09-26  Xiaomei Ji  <xji at chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        This Patch fixes [chromium] the drop-down is always left-aligned even
-        for RTL element.
-        https://bugs.webkit.org/show_bug.cgi?id=29612
-
-        For auto-complete, the items in drop-down should be right-aligned if
-        the directionality of <input> field is RTL.
-        For <select><option>, the items in drop-down should be right-aligned
-        if the directionality of <select> is RTL.
-
-        No automatic test is possible. Manual tests are added.
-
-        * manual-tests/autofill_alignment.html: Added.
-        * manual-tests/select_alignment.html: Added.
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::paintRow): Adjust the starting x-axis of text to
-        be paint if it should be right-aligned.
-
-2009-09-25  Dan Bernstein  <mitz at apple.com>
-
-        Reviewed by Sam Weinig.
-
-        REGRESSION (r48775) FontList.plist written by TOT WebKit causes Safari 4
-        to crash on launch
-        https://bugs.webkit.org/show_bug.cgi?id=29759
-
-        * platform/graphics/win/FontDatabase.cpp:
-        (WebCore::writeFontDatabaseToPlist): Reverted to saving the CG font DB
-        property list at the root of FontList.plist, but with an additional
-        key for the last value of the Fonts registry key.
-        (WebCore::populateFontDatabase): Pass the FontList.plist in its entirety
-        to populatFontDatabaseFromPlist.
-
-2009-09-25  Kevin Ollivier  <kevino at theolliviers.com>
-
-        Build fix. Adding missing header files.
-
-        * bindings/js/JSNamedNodeMapCustom.cpp:
-
-2009-09-25  David Kilzer  <ddkilzer at apple.com>
-
-        Part 1 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
-
-        Reviewed by Darin Adler.
-
-        * DerivedSources.make: Move tests for ENABLE_CONTEXT_MENUS,
-        ENABLE_DRAG_SUPPORT and ENABLE_INSPECTOR into Mac-only section.
-
-2009-09-25  Adam Barth  <abarth at webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Load blocks during unload should not affect targeted loads
-        https://bugs.webkit.org/show_bug.cgi?id=29747
-
-        Move the check of the unload state after checking for targeted links.
-
-        Test: fast/loader/unload-hyperlink-targeted.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadURL):
-
-2009-09-25  Kenneth Russell  <kbr at google.com>
-
-        Reviewed by Dimitri Glazkov.
-
-        [Chromium] Add initial V8 bindings for WebGL
-        https://bugs.webkit.org/show_bug.cgi?id=29664
-
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8CanvasArrayBufferCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CanvasArrayCustom.h: Added.
-        (WebCore::constructCanvasArray):
-        * bindings/v8/custom/V8CanvasByteArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasFloatArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasIntArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp: Added.
-        (WebCore::jsArrayToFloatArray):
-        (WebCore::jsArrayToIntArray):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::):
-        (WebCore::vertexAttribAndUniformHelperf):
-        (WebCore::uniformHelperi):
-        (WebCore::uniformMatrixHelper):
-        * bindings/v8/custom/V8CanvasShortArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * platform/graphics/GraphicsContext3D.h:
-
-2009-09-25  Jeremy Orlow  <jorlow at chromium.org>
-
-        This is breaking Chromium try bots, so I'm counting this as a build fix.
-
-        Add more svn:ignore exceptions.  On different platforms, these files are
-        generated with different case for WebCore.
-
-        * WebCore.gyp: Changed property svn:ignore.
-
-2009-09-25  Alexey Proskuryakov  <ap at apple.com>
-
-        Reverting r48767, as it broke Windows build in a non-trivial way.
-
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::jsFunction):
-        (WebCore::JSEventListener::markJSFunction):
-        (WebCore::JSEventListener::handleEvent):
-        (WebCore::JSEventListener::reportError):
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSEventListener::create):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSLazyEventListener.cpp:
-        (WebCore::JSLazyEventListener::JSLazyEventListener):
-        (WebCore::JSLazyEventListener::jsFunction):
-        (WebCore::JSLazyEventListener::parseCode):
-        * bindings/js/JSLazyEventListener.h:
-        (WebCore::JSLazyEventListener::create):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::handleEvent):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventListener.h:
-        (WebCore::EventListener::reportError):
-        (WebCore::EventListener::jsFunction):
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::fireEventListeners):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * inspector/InspectorDOMStorageResource.h:
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::handleEvent):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
-
-2009-09-24  Tony Chang  <tony at chromium.org>
-
-        Reviewed by David Levin.
-
-        Add a gyp variable to allow building a debug webcore without debug
-        symbols.  This allows for faster compile, link, and gdb times.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29721
-
-        No new tests, build config change.
-
-        * WebCore.gyp/WebCore.gyp:
-
-2009-09-25  Darin Fisher  <darin at chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Declare RegisteredEventListener as a class instead of a struct.
-        This fixes a warning in the Chromium build.
-
-        * dom/RegisteredEventListener.h:
-
-2009-09-25  Dan Bernstein  <mitz at apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        WebCore part of
-        <rdar://problem/7211635> 2 byte characters are displayed as garbaged
-        <rdar://problem/7212626> garbled/gibberish text (off-by-one)
-
-        When the Windows Fonts directory contains more than one font file for a
-        given font name, which of the fonts gets assigned to the name in the
-        Core Graphics font database was determined arbitrarily and did not
-        always match the font GDI used for the same font name. The mismatch
-        caused character-to-glyph mapping to use one font and glyph rendering to
-        use another.
-
-        The fix is to update the Core Graphics font database from the registry
-        entries (that reflect the name-to-font mapping that GDI uses) after
-        populating it with the result of scanning the Fonts directory. As a
-        consequence, the directory needs to be scanned at startup every time the
-        registry key changes, so the last value of the registry key is kept
-        in the property list on disk so that it could be compared to the current
-        value on startup.
-
-        * platform/graphics/win/FontDatabase.cpp:
-        (WebCore::populateFontDatabaseFromPlist): Now takes a property list as
-        a parameter and avoids round-tripping through XML by calling
-        wkAddFontsFromPlist() instead of wkAddFontsFromPlistRepresentation().
-        (WebCore::fontFilenamesFromRegistryKey):
-        (WebCore::cgFontDBKey):
-        (WebCore::writeFontDatabaseToPlist): Now takes the CG font DB property
-        list and a property list with the font filenames from the registry and
-        writes a dictionary with those property lists as values.
-        (WebCore::fontFilenamesFromRegistry): Added. Returns an array with the
-        values in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
-        registry key.
-        (WebCore::populateFontDatabase): Changed to read the contents of the
-        Fonts registry key and compare it with the last-saved value from the
-        property list, and to call wkAddFontsFromRegistry() after populating the
-        CG font DB from the file system. Uses wkCreateFontsPlist() instead of
-        wkCreateFontsPlistRepresentation() to avoid round-tripping through XML.
-
-2009-09-25  Geoffrey Garen  <ggaren at apple.com>
-
-        Reviewed by Darin Adler.
-
-        Inlined some object creation code, including lexicalGlobalObject access
-        https://bugs.webkit.org/show_bug.cgi?id=29750
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::currentCallFrame):
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::hasBreakpoint): Updated for JavaScriptCore
-        API changes.
-
-2009-09-25  Dave Hyatt  <hyatt at apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24399
-        Make @import work in user stylesheets.  The first bug was that the URL wasn't being set on the
-        user sheets themselves, so relative @import URLs couldn't resolve properly.  The second bug
-        was that the loads would be denied.  This is fixed by using the requestUserCSSStyleSheet method
-        instead of the normal request method.  In order to know when to do this, CSSStyleSheets now have
-        a propagated boolean, m_isUserStyleSheet, that lets them know if they are user stylesheets or not.
-
-        * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::insertedIntoParent):
-        * css/CSSStyleSheet.cpp:
-        (WebCore::CSSStyleSheet::CSSStyleSheet):
-        * css/CSSStyleSheet.h:
-        (WebCore::CSSStyleSheet::setIsUserStyleSheet):
-        (WebCore::CSSStyleSheet::isUserStyleSheet):
-        * dom/Document.cpp:
-        (WebCore::Document::pageUserSheet):
-        (WebCore::Document::pageGroupUserSheets):
-
-2009-09-25  Simon Fraser  <simon.fraser at apple.com>
-
-        Reviewed by Darin Adler.
-
-        Crash with hardware accelerated rotation of a PDF image in a data URL
-        <rdar://problem/7250378>
-        
-        PDF images don't return a color space from CGImageGetColorSpace(),
-        so we need to null-check the return value before use.
-
-        Test: compositing/color-matching/pdf-image-match.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setContentsToImage):
-
-2009-09-25  Darin Adler  <darin at apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Null-deref when first access to an Attr node is after its Element is destroyed
-        https://bugs.webkit.org/show_bug.cgi?id=29748
-
-        Test: fast/dom/Attr/access-after-element-destruction.html
-
-        * bindings/js/JSAttrCustom.cpp:
-        (WebCore::JSAttr::markChildren): Added. Keeps the ownerElement alive as
-        long as the Attr is alive.
-
-        * bindings/js/JSNamedNodeMapCustom.cpp:
-        (WebCore::JSNamedNodeMap::markChildren): Added. Keeps the Element alive as
-        long as the NamedNodeMap is alive.
-
-        * dom/Attr.idl: Added CustomMarkFunction attribute.
-
-        * dom/NamedAttrMap.cpp:
-        (WebCore::NamedNodeMap::getAttributeItem): Tweaked formatting.
-        (WebCore::NamedNodeMap::detachFromElement): Call clearAttributes so we don't
-        have attributes hanging around that might need an Attr node created; that way
-        we won't crash with a null-dereference trying to deal with one of them. This
-        can't happen when working with JavaScript since the Element will be kept
-        alive due to the change above.
-        (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
-        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "+ 1" and added
-        missing braces.
-
-        * dom/NamedAttrMap.h: Made the element function public so it can be used by
-        the JavaScript binding to keep the Element alive.
-
-        * dom/NamedNodeMap.idl: Added CustomMarkFunction attribute.
-
 2009-09-24  Alexey Proskuryakov  <ap at apple.com>
 
         Reviewed by Darin Adler and Sam Weinig.
diff --git a/WebCore/bindings/js/JSAttrCustom.cpp b/WebCore/bindings/js/JSAttrCustom.cpp
index e217023..14457c4 100644
--- a/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/WebCore/bindings/js/JSAttrCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -59,4 +59,16 @@ void JSAttr::setValue(ExecState* exec, JSValue value)
     setDOMException(exec, ec);
 }
 
+void JSAttr::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    // Mark the element so that this will work to access the attribute even if the last
+    // other reference goes away.
+    if (Element* element = impl()->ownerElement()) {
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
+            markStack.append(wrapper);
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index 7bd95b4..93aedca 100644
--- a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,10 +27,6 @@
 #include "JSNamedNodeMap.h"
 
 #include "JSNode.h"
-#include "NamedNodeMap.h"
-#include "Node.h"
-#include "PlatformString.h"
-#include "JSDOMBinding.h"
 
 using namespace JSC;
 
@@ -47,4 +43,16 @@ JSValue JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyNa
     return toJS(exec, thisObj->impl()->getNamedItem(propertyName));
 }
 
+void JSNamedNodeMap::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    // Mark the element so that this will work to access the attribute even if the last
+    // other reference goes away.
+    if (Element* element = impl()->element()) {
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
+            markStack.append(wrapper);
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/dom/Attr.idl b/WebCore/dom/Attr.idl
index 29f4be1..c01f34a 100644
--- a/WebCore/dom/Attr.idl
+++ b/WebCore/dom/Attr.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig at gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         GenerateNativeConverter,
         InterfaceUUID=EEE8E22B-22C3-4e50-95F4-5E0B8AAD8231,
diff --git a/WebCore/dom/NamedAttrMap.cpp b/WebCore/dom/NamedAttrMap.cpp
index fe631c8..d4ec598 100644
--- a/WebCore/dom/NamedAttrMap.cpp
+++ b/WebCore/dom/NamedAttrMap.cpp
@@ -178,10 +178,8 @@ Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreA
 {
     unsigned len = length();
     for (unsigned i = 0; i < len; ++i) {
-        if (!m_attributes[i]->name().hasPrefix() && 
-            m_attributes[i]->name().localName() == name)
-                return m_attributes[i].get();
-
+        if (!m_attributes[i]->name().hasPrefix() && m_attributes[i]->name().localName() == name)
+            return m_attributes[i].get();
         if (shouldIgnoreAttributeCase ? equalIgnoringCase(m_attributes[i]->name().toString(), name) : name == m_attributes[i]->name().toString())
             return m_attributes[i].get();
     }
@@ -206,10 +204,12 @@ void NamedNodeMap::clearAttributes()
 
 void NamedNodeMap::detachFromElement()
 {
-    // we allow a NamedNodeMap w/o an element in case someone still has a reference
-    // to if after the element gets deleted - but the map is now invalid
+    // This can't happen if the holder of the map is JavaScript, because we mark the
+    // element if the map is alive. So it has no impact on web page behavior. Because
+    // of that, we can simply clear all the attributes to avoid accessing stale
+    // pointers to do things like create Attr objects.
     m_element = 0;
-    detachAttributesFromElement();
+    clearAttributes();
 }
 
 void NamedNodeMap::setAttributes(const NamedNodeMap& other)
@@ -251,7 +251,7 @@ void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
         attr->m_element = m_element;
 
     // Notify the element that the attribute has been added, and dispatch appropriate mutation events
-    // Note that element may be null here if we are called from insertAttr() during parsing
+    // Note that element may be null here if we are called from insertAttribute() during parsing
     if (m_element) {
         m_element->attributeChanged(attribute.get());
         // Because of our updateStyleAttribute() style modification events are never sent at the right time, so don't bother sending them.
@@ -265,12 +265,13 @@ void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
 void NamedNodeMap::removeAttribute(const QualifiedName& name)
 {
     unsigned len = length();
-    unsigned index = len + 1;
-    for (unsigned i = 0; i < len; ++i)
+    unsigned index = len;
+    for (unsigned i = 0; i < len; ++i) {
         if (m_attributes[i]->name().matches(name)) {
             index = i;
             break;
         }
+    }
 
     if (index >= len)
         return;
diff --git a/WebCore/dom/NamedAttrMap.h b/WebCore/dom/NamedAttrMap.h
index 4fb96de..759900b 100644
--- a/WebCore/dom/NamedAttrMap.h
+++ b/WebCore/dom/NamedAttrMap.h
@@ -94,11 +94,11 @@ public:
     void addAttribute(PassRefPtr<Attribute>);
     void removeAttribute(const QualifiedName&);
 
+    Element* element() const { return m_element; }
+
 protected:
     virtual void clearAttributes();
 
-    Element* element() const { return m_element; }
-
 private:
     void detachAttributesFromElement();
     void detachFromElement();
diff --git a/WebCore/dom/NamedNodeMap.idl b/WebCore/dom/NamedNodeMap.idl
index 3310ded..8166853 100644
--- a/WebCore/dom/NamedNodeMap.idl
+++ b/WebCore/dom/NamedNodeMap.idl
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Samuel Weinig <sam.weinig at gmail.com>
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         HasIndexGetter,
         HasNameGetter,

-- 
WebKit Debian packaging



More information about the Pkg-webkit-commits mailing list