[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373

[mitz at apple.com]

The following commit has been merged in the webkit-1.2 branch:
commit 1aa6c4d3b145feaf59c708318e20dc7cced6f42f
Author: mitz at apple.com <mitz at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Wed Mar 3 15:02:30 2010 +0000

    <rdar://problem/7682756> Assertion failure when replacing the contents of a <select>
    
    Reviewed by Sam Weinig.
    
    WebCore:
    
    Test: fast/dom/remove-children-notification-order.html
    
    * dom/ContainerNode.cpp:
    (WebCore::ContainerNode::removeChildren): Changed to call childrenChanged()
    before calling removedFromDocument() on each removed child, which matches
    the order removeChild() does things, and avoids the assertion. This required
    temporarily storing the removed children in a vector.
    Also added comments about other discrepancies between this function and
    removeChild().
    
    LayoutTests:
    
    * fast/dom/remove-children-notification-order-expected.txt: Added.
    * fast/dom/remove-children-notification-order.html: Added.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@55462 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 87be4b2..9536602 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,12 @@
+2010-03-03  Dan Bernstein  <mitz at apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7682756> Assertion failure when replacing the contents of a <select>
+
+        * fast/dom/remove-children-notification-order-expected.txt: Added.
+        * fast/dom/remove-children-notification-order.html: Added.
+
 2010-03-03  Gustavo Noronha Silva  <gustavo.noronha at collabora.co.uk>
 
         [GTK] build slaves need working geoclue service
diff --git a/LayoutTests/fast/forms/menulist-selection-reset-expected.txt b/LayoutTests/fast/dom/remove-children-notification-order-expected.txt
similarity index 100%
copy from LayoutTests/fast/forms/menulist-selection-reset-expected.txt
copy to LayoutTests/fast/dom/remove-children-notification-order-expected.txt
diff --git a/LayoutTests/fast/dom/remove-children-notification-order.html b/LayoutTests/fast/dom/remove-children-notification-order.html
new file mode 100644
index 0000000..823ce89
--- /dev/null
+++ b/LayoutTests/fast/dom/remove-children-notification-order.html
@@ -0,0 +1,18 @@
+<select id="target">
+    <option>FAIL</option>
+</select>
+<p id="result">
+    FAIL: Test did not run
+</p>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    var target = document.getElementById("target");
+    target.appendChild(document.createElement("link"));
+    target.offsetTop;
+
+    target.innerHTML = "<option>PASS</option>";
+
+    document.getElementById("result").innerHTML = target.value;
+</script>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 20bb3ca..8bcf81e 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2010-03-03  Dan Bernstein  <mitz at apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7682756> Assertion failure when replacing the contents of a <select>
+
+        Test: fast/dom/remove-children-notification-order.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren): Changed to call childrenChanged()
+        before calling removedFromDocument() on each removed child, which matches
+        the order removeChild() does things, and avoids the assertion. This required
+        temporarily storing the removed children in a vector.
+        Also added comments about other discrepancies between this function and
+        removeChild().
+
 2010-03-03  Adam Barth  <abarth at webkit.org>
 
         Reviewed by Darin Adler.
diff --git a/WebCore/dom/ContainerNode.cpp b/WebCore/dom/ContainerNode.cpp
index 39cd3b4..8ab78ac 100644
--- a/WebCore/dom/ContainerNode.cpp
+++ b/WebCore/dom/ContainerNode.cpp
@@ -396,33 +396,43 @@ bool ContainerNode::removeChildren()
     document()->removeFocusedNodeOfSubtree(this, true);
 
     forbidEventDispatch();
-    int childCountDelta = 0;
+    Vector<RefPtr<Node> > removedChildren;
     while (RefPtr<Node> n = m_firstChild) {
-        childCountDelta--;
-
         Node* next = n->nextSibling();
         
-        // Remove the node from the tree before calling detach or removedFromDocument (4427024, 4129744)
+        // Remove the node from the tree before calling detach or removedFromDocument (4427024, 4129744).
+        // removeChild() does this after calling detach(). There is no explanation for
+        // this discrepancy between removeChild() and its optimized version removeChildren().
         n->setPreviousSibling(0);
         n->setNextSibling(0);
         n->setParent(0);
-        
+
         m_firstChild = next;
         if (n == m_lastChild)
             m_lastChild = 0;
 
         if (n->attached())
             n->detach();
-        
-        if (n->inDocument())
-            n->removedFromDocument();
+
+        removedChildren.append(n.release());
     }
     allowEventDispatch();
 
+    size_t removedChildrenCount = removedChildren.size();
+
     // Dispatch a single post-removal mutation event denoting a modified subtree.
-    childrenChanged(false, 0, 0, childCountDelta);
+    childrenChanged(false, 0, 0, -removedChildrenCount);
     dispatchSubtreeModifiedEvent();
 
+    for (size_t i = 0; i < removedChildrenCount; ++i) {
+        Node* removedChild = removedChildren[i].get();
+        if (removedChild->inDocument())
+            removedChild->removedFromDocument();
+        // removeChild() calls removedFromTree(true) if the child was not in the
+        // document. There is no explanation for this discrepancy between removeChild()
+        // and its optimized version removeChildren().
+    }
+
     return true;
 }
 

-- 
WebKit Debian packaging