[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373

jamesr at google.com jamesr at google.com
Thu Apr 8 02:10:31 UTC 2010


The following commit has been merged in the webkit-1.2 branch:
commit b76a7b097b2f41de8f30a636c14c53e1d37c3e15
Author: jamesr at google.com <jamesr at google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Thu Mar 4 23:29:18 2010 +0000

    2010-03-04  James Robinson  <jamesr at chromium.org>
    
            Reviewed by Dimitri Glazkov.
    
            Handles setting HTMLSelectElement.length with mutation handlers present
            https://bugs.webkit.org/show_bug.cgi?id=33983
    
            When setting an HTMLSelectElement's length attribute, option elements have to be added or removed to the select
            as appropriate.  This is a little tricky with mutation events since they might add, remove, or reorder elements
            while option elements are being added or deleted.
    
            Tests: fast/forms/select-set-length-optgroup.html
                   fast/forms/select-set-length-with-mutation-remove.html
                   fast/forms/select-set-length-with-mutation-reorder.html
                   fast/forms/select-set-length-with-mutation-reparent.html
                   fast/forms/select-set-length-with-mutation.html
                   fast/forms/select-set-length.html
    
            * html/HTMLSelectElement.cpp:
            (WebCore::HTMLSelectElement::setLength):
    2010-03-04  James Robinson  <jamesr at chromium.org>
    
            Reviewed by Dimitri Glazkov.
    
            Tests for setting an select's options.length attribute.
            https://bugs.webkit.org/show_bug.cgi?id=33983
    
            * fast/forms/script-tests/select-set-length-optgroup.js: Added.
            * fast/forms/script-tests/select-set-length-with-mutation-remove.js: Added.
            (gc):
            (onRemove):
            * fast/forms/script-tests/select-set-length-with-mutation-reorder.js: Added.
            (onRemove):
            * fast/forms/script-tests/select-set-length-with-mutation-reparent.js: Added.
            (onRemove):
            * fast/forms/script-tests/select-set-length-with-mutation.js: Added.
            (sel):
            * fast/forms/script-tests/select-set-length.js: Added.
            * fast/forms/select-set-length-expected.txt: Added.
            * fast/forms/select-set-length-optgroup-expected.txt: Added.
            * fast/forms/select-set-length-optgroup.html: Added.
            * fast/forms/select-set-length-with-mutation-expected.txt: Added.
            * fast/forms/select-set-length-with-mutation-remove-expected.txt: Added.
            * fast/forms/select-set-length-with-mutation-remove.html: Added.
            * fast/forms/select-set-length-with-mutation-reorder-expected.txt: Added.
            * fast/forms/select-set-length-with-mutation-reorder.html: Added.
            * fast/forms/select-set-length-with-mutation-reparent-expected.txt: Added.
            * fast/forms/select-set-length-with-mutation-reparent.html: Added.
            * fast/forms/select-set-length-with-mutation.html: Added.
            * fast/forms/select-set-length.html: Added.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@55557 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 75b639b..1ea7f80 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,34 @@
+2010-03-04  James Robinson  <jamesr at chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Tests for setting an select's options.length attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=33983
+
+        * fast/forms/script-tests/select-set-length-optgroup.js: Added.
+        * fast/forms/script-tests/select-set-length-with-mutation-remove.js: Added.
+        (gc):
+        (onRemove):
+        * fast/forms/script-tests/select-set-length-with-mutation-reorder.js: Added.
+        (onRemove):
+        * fast/forms/script-tests/select-set-length-with-mutation-reparent.js: Added.
+        (onRemove):
+        * fast/forms/script-tests/select-set-length-with-mutation.js: Added.
+        (sel):
+        * fast/forms/script-tests/select-set-length.js: Added.
+        * fast/forms/select-set-length-expected.txt: Added.
+        * fast/forms/select-set-length-optgroup-expected.txt: Added.
+        * fast/forms/select-set-length-optgroup.html: Added.
+        * fast/forms/select-set-length-with-mutation-expected.txt: Added.
+        * fast/forms/select-set-length-with-mutation-remove-expected.txt: Added.
+        * fast/forms/select-set-length-with-mutation-remove.html: Added.
+        * fast/forms/select-set-length-with-mutation-reorder-expected.txt: Added.
+        * fast/forms/select-set-length-with-mutation-reorder.html: Added.
+        * fast/forms/select-set-length-with-mutation-reparent-expected.txt: Added.
+        * fast/forms/select-set-length-with-mutation-reparent.html: Added.
+        * fast/forms/select-set-length-with-mutation.html: Added.
+        * fast/forms/select-set-length.html: Added.
+
 2010-03-04  Nate Chapin  <japhet at chromium.org>
 
         Reviewed by Kenneth Rohde Christiansen.
diff --git a/LayoutTests/fast/forms/script-tests/select-set-length-optgroup.js b/LayoutTests/fast/forms/script-tests/select-set-length-optgroup.js
new file mode 100644
index 0000000..5f5e4cc
--- /dev/null
+++ b/LayoutTests/fast/forms/script-tests/select-set-length-optgroup.js
@@ -0,0 +1,30 @@
+description('This test that setting HTMLSelectElement.length respects optgroups.');
+
+var wrapper = document.createElement('div');
+document.body.appendChild(wrapper);
+wrapper.innerHTML = '<select id="theSelect">'+
+                    '<optgroup label="foo" id="theOptGroup">'+
+                    '<option id="optionInGroup"></option>'+
+                    '</optgroup>'+
+                    '</select>';
+
+var sel = document.getElementById('theSelect');
+shouldBe('sel.length', '1');
+
+var og = document.getElementById('theOptGroup');
+
+sel.length = 2;
+shouldBe('sel.length', '2');
+shouldBe('og.childElementCount', '1');
+
+sel.length = 1;
+shouldBe('sel.length', '1');
+shouldBe('og.childElementCount', '1');
+
+sel.insertBefore(document.createElement('option'), og);
+
+sel.length = 1;
+shouldBe('sel.length', '1');
+shouldBe('og.childElementCount', '0');
+
+var successfullyParsed = true;
diff --git a/LayoutTests/fast/forms/script-tests/select-set-length-with-mutation-remove.js b/LayoutTests/fast/forms/script-tests/select-set-length-with-mutation-remove.js
new file mode 100644
index 0000000..9a8b467
--- /dev/null
+++ b/LayoutTests/fast/forms/script-tests/select-set-length-with-mutation-remove.js
@@ -0,0 +1,37 @@
+description('Tests that setting .length on an HTMLSelectElement works in the presence of mutation listeners that remove option elements.');
+
+function gc() {
+    if (window.GCController)
+        return GCController.collect();
+
+    for (var i=0; i<10000; ++i) {
+        var s = new String("abc");
+    }
+}
+
+function onRemove(e) {
+    if (e.target.nextSibling != null) {
+        // remove listener temporarily to avoid lots of nesting
+        sel.removeEventListener('DOMNodeRemoved', onRemove, false);
+        e.target.nextSibling.parentNode.removeChild(e.target.nextSibling);
+        sel.addEventListener('DOMNodeRemoved', onRemove, false);
+    }
+    gc();
+}
+
+var sel = document.createElement('select');
+document.body.appendChild(sel);
+
+sel.addEventListener('DOMNodeRemoved', onRemove, false);
+sel.addEventListener('DOMNodeInserted', function() {}, false);
+
+sel.length = 200;
+shouldBe('sel.length', '200');
+
+sel.length = 100;
+shouldBe('sel.length', '100');
+
+sel.length = 180;
+shouldBe('sel.length', '180');
+
+var successfullyParsed = true;
diff --git a/LayoutTests/fast/forms/script-tests/select-set-length-with-mutation-reorder.js b/LayoutTests/fast/forms/script-tests/select-set-length-with-mutation-reorder.js
new file mode 100644
index 0000000..ed827db
--- /dev/null
+++ b/LayoutTests/fast/forms/script-tests/select-set-length-with-mutation-reorder.js
@@ -0,0 +1,36 @@
+description('Tests that setting the .length on an HTMLSelectElement works in the presence of DOM mutation listeners that reorder option elements');
+
+var wrapper = document.createElement('div');
+document.body.appendChild(wrapper);
+wrapper.innerHTML = '<select id="theSelect">' +
+                    '<option id="a">a</option>' +
+                    '<option id="b">b</option>' +
+                    '<option id="c">c</option>' +
+                    '<option id="d">d</option>' +
+                    '</select>';
+
+var sel = document.getElementById('theSelect');
+
+var firstRemove = true;
+function onRemove(e) {
+    if (firstRemove) {
+        // remove listener temporarily to avoid lots of nesting
+        sel.removeEventListener('DOMNodeRemoved', onRemove, false);
+        var lastOption = document.getElementById('d');
+        sel.removeChild(lastOption);
+        sel.insertBefore(lastOption, document.getElementById('c'));
+        firstRemove = false;
+        sel.addEventListener('DOMNodeRemoved', onRemove, false);
+    }
+}
+
+sel.addEventListener('DOMNodeRemoved', onRemove, false);
+sel.addEventListener('DOMNodeInserted', function() {}, false);
+
+shouldBe('sel.length', '4');
+sel.length = 2;
+shouldBe('sel.length', '2');
+shouldBe('sel.options.item(0).id', '"a"');
+shouldBe('sel.options.item(1).id', '"b"');
+
+var successfullyParsed = true;
diff --git a/LayoutTests/fast/forms/script-tests/select-set-length-with-mutation-reparent.js b/LayoutTests/fast/forms/script-tests/select-set-length-with-mutation-reparent.js
new file mode 100644
index 0000000..ed4a09b
--- /dev/null
+++ b/LayoutTests/fast/forms/script-tests/select-set-length-with-mutation-reparent.js
@@ -0,0 +1,34 @@
+description('Tests that setting .length on an HTMLSelectElement works in the presence of mutation event listeners that reparent options');
+
+var sel = document.createElement('select');
+document.body.appendChild(sel);
+var otherSel = document.createElement('select');
+document.body.appendChild(otherSel);
+
+function onRemove(e) {
+    if (e.target.nextSibling != null) {
+        // remove listener temporarily to avoid lots of nesting
+        sel.removeEventListener('DOMNodeRemoved', onRemove, false);
+        var n = e.target.nextSibling;
+        n.parentNode.removeChild(n);
+        otherSel.appendChild(n);
+        sel.addEventListener('DOMNodeRemoved', onRemove, false);
+    }
+}
+
+sel.addEventListener('DOMNodeRemoved', onRemove, false);
+sel.addEventListener('DOMNodeInserted', function() {}, false);
+
+sel.length = 200;
+shouldBe('sel.length', '200');
+shouldBe('otherSel.length', '0');
+
+sel.length = 100;
+shouldBe('sel.length', '100');
+shouldBe('otherSel.length', '0');
+
+sel.length = 180;
+shouldBe('sel.length', '180');
+shouldBe('otherSel.length', '0');
+
+var successfullyParsed = true;
diff --git a/LayoutTests/fast/forms/script-tests/select-set-length-with-mutation.js b/LayoutTests/fast/forms/script-tests/select-set-length-with-mutation.js
new file mode 100644
index 0000000..d1de71c
--- /dev/null
+++ b/LayoutTests/fast/forms/script-tests/select-set-length-with-mutation.js
@@ -0,0 +1,18 @@
+description('Tests setting the .length of an HTMLSelectElement with mutation listeners registered.');
+
+var sel = document.createElement('select');
+document.body.appendChild(sel);
+
+sel.addEventListener('DOMNodeRemoved', function() {}, false);
+sel.addEventListener('DOMNodeInserted', function() {}, false);
+
+sel.length = 200;
+shouldBe('sel.length', '200');
+
+sel.length = 100;
+shouldBe('sel.length', '100');
+
+sel.length = 180;
+shouldBe('sel.length', '180');
+
+var successfullyParsed = true;
diff --git a/LayoutTests/fast/forms/script-tests/select-set-length.js b/LayoutTests/fast/forms/script-tests/select-set-length.js
new file mode 100644
index 0000000..6483c80
--- /dev/null
+++ b/LayoutTests/fast/forms/script-tests/select-set-length.js
@@ -0,0 +1,17 @@
+description('Tests that setting the .length of an HTMLSelectElement correctly creates and destroys options.');
+
+var sel = document.createElement('select');
+document.body.appendChild(sel);
+
+shouldBe('sel.length', '0');
+
+sel.length = 200;
+shouldBe('sel.length', '200');
+
+sel.length = 100;
+shouldBe('sel.length', '100');
+
+sel.length = 180;
+shouldBe('sel.length', '180');
+
+var successfullyParsed = true;
diff --git a/LayoutTests/fast/forms/select-set-length-expected.txt b/LayoutTests/fast/forms/select-set-length-expected.txt
new file mode 100644
index 0000000..996e1f5
--- /dev/null
+++ b/LayoutTests/fast/forms/select-set-length-expected.txt
@@ -0,0 +1,13 @@
+Tests that setting the .length of an HTMLSelectElement correctly creates and destroys options.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS sel.length is 0
+PASS sel.length is 200
+PASS sel.length is 100
+PASS sel.length is 180
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/forms/select-set-length-optgroup-expected.txt b/LayoutTests/fast/forms/select-set-length-optgroup-expected.txt
new file mode 100644
index 0000000..7130b3f
--- /dev/null
+++ b/LayoutTests/fast/forms/select-set-length-optgroup-expected.txt
@@ -0,0 +1,16 @@
+This test that setting HTMLSelectElement.length respects optgroups.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS sel.length is 1
+PASS sel.length is 2
+PASS og.childElementCount is 1
+PASS sel.length is 1
+PASS og.childElementCount is 1
+PASS sel.length is 1
+PASS og.childElementCount is 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/forms/select-set-length-optgroup.html b/LayoutTests/fast/forms/select-set-length-optgroup.html
new file mode 100644
index 0000000..9a35a4f
--- /dev/null
+++ b/LayoutTests/fast/forms/select-set-length-optgroup.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/select-set-length-optgroup.js"></script>
+<script src="../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/forms/select-set-length-with-mutation-expected.txt b/LayoutTests/fast/forms/select-set-length-with-mutation-expected.txt
new file mode 100644
index 0000000..f2bc67f
--- /dev/null
+++ b/LayoutTests/fast/forms/select-set-length-with-mutation-expected.txt
@@ -0,0 +1,12 @@
+Tests setting the .length of an HTMLSelectElement with mutation listeners registered.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS sel.length is 200
+PASS sel.length is 100
+PASS sel.length is 180
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/forms/select-set-length-with-mutation-remove-expected.txt b/LayoutTests/fast/forms/select-set-length-with-mutation-remove-expected.txt
new file mode 100644
index 0000000..3679322
--- /dev/null
+++ b/LayoutTests/fast/forms/select-set-length-with-mutation-remove-expected.txt
@@ -0,0 +1,12 @@
+Tests that setting .length on an HTMLSelectElement works in the presence of mutation listeners that remove option elements.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS sel.length is 200
+PASS sel.length is 100
+PASS sel.length is 180
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/forms/select-set-length-with-mutation-remove.html b/LayoutTests/fast/forms/select-set-length-with-mutation-remove.html
new file mode 100644
index 0000000..ac84ec5
--- /dev/null
+++ b/LayoutTests/fast/forms/select-set-length-with-mutation-remove.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/select-set-length-with-mutation-remove.js"></script>
+<script src="../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/forms/select-set-length-with-mutation-reorder-expected.txt b/LayoutTests/fast/forms/select-set-length-with-mutation-reorder-expected.txt
new file mode 100644
index 0000000..12bea03
--- /dev/null
+++ b/LayoutTests/fast/forms/select-set-length-with-mutation-reorder-expected.txt
@@ -0,0 +1,13 @@
+Tests that setting the .length on an HTMLSelectElement works in the presence of DOM mutation listeners that reorder option elements
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS sel.length is 4
+PASS sel.length is 2
+PASS sel.options.item(0).id is "a"
+PASS sel.options.item(1).id is "b"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/forms/select-set-length-with-mutation-reorder.html b/LayoutTests/fast/forms/select-set-length-with-mutation-reorder.html
new file mode 100644
index 0000000..4e6e587
--- /dev/null
+++ b/LayoutTests/fast/forms/select-set-length-with-mutation-reorder.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/select-set-length-with-mutation-reorder.js"></script>
+<script src="../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/forms/select-set-length-with-mutation-reparent-expected.txt b/LayoutTests/fast/forms/select-set-length-with-mutation-reparent-expected.txt
new file mode 100644
index 0000000..4e9aa89
--- /dev/null
+++ b/LayoutTests/fast/forms/select-set-length-with-mutation-reparent-expected.txt
@@ -0,0 +1,15 @@
+Tests that setting .length on an HTMLSelectElement works in the presence of mutation event listeners that reparent options
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS sel.length is 200
+PASS otherSel.length is 0
+PASS sel.length is 100
+PASS otherSel.length is 0
+PASS sel.length is 180
+PASS otherSel.length is 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/forms/select-set-length-with-mutation-reparent.html b/LayoutTests/fast/forms/select-set-length-with-mutation-reparent.html
new file mode 100644
index 0000000..3974de8
--- /dev/null
+++ b/LayoutTests/fast/forms/select-set-length-with-mutation-reparent.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/select-set-length-with-mutation-reparent.js"></script>
+<script src="../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/forms/select-set-length-with-mutation.html b/LayoutTests/fast/forms/select-set-length-with-mutation.html
new file mode 100644
index 0000000..93e8f68
--- /dev/null
+++ b/LayoutTests/fast/forms/select-set-length-with-mutation.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/select-set-length-with-mutation.js"></script>
+<script src="../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/forms/select-set-length.html b/LayoutTests/fast/forms/select-set-length.html
new file mode 100644
index 0000000..3f066ac
--- /dev/null
+++ b/LayoutTests/fast/forms/select-set-length.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/select-set-length.js"></script>
+<script src="../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 8aeabf0..198df8a 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,24 @@
+2010-03-04  James Robinson  <jamesr at chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Handles setting HTMLSelectElement.length with mutation handlers present
+        https://bugs.webkit.org/show_bug.cgi?id=33983
+
+        When setting an HTMLSelectElement's length attribute, option elements have to be added or removed to the select
+        as appropriate.  This is a little tricky with mutation events since they might add, remove, or reorder elements
+        while option elements are being added or deleted.
+
+        Tests: fast/forms/select-set-length-optgroup.html
+               fast/forms/select-set-length-with-mutation-remove.html
+               fast/forms/select-set-length-with-mutation-reorder.html
+               fast/forms/select-set-length-with-mutation-reparent.html
+               fast/forms/select-set-length-with-mutation.html
+               fast/forms/select-set-length.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setLength):
+
 2010-03-04  Csaba Osztrogonác  <ossy at webkit.org>
 
         [Qt] Unreviewed buildfix after r55542 on Windows.
diff --git a/WebCore/html/HTMLSelectElement.cpp b/WebCore/html/HTMLSelectElement.cpp
index 50639e9..f11755f 100644
--- a/WebCore/html/HTMLSelectElement.cpp
+++ b/WebCore/html/HTMLSelectElement.cpp
@@ -418,11 +418,21 @@ void HTMLSelectElement::setLength(unsigned newLen, ExceptionCode& ec)
     } else {
         const Vector<Element*>& items = listItems();
 
+        // Removing children fires mutation events, which might mutate the DOM further, so we first copy out a list
+        // of elements that we intend to remove then attempt to remove them one at a time.
+        Vector<RefPtr<Element> > itemsToRemove;
         size_t optionIndex = 0;
-        for (size_t listIndex = 0; listIndex < items.size(); listIndex++) {
-            if (items[listIndex]->hasLocalName(optionTag) && optionIndex++ >= newLen) {
-                Element *item = items[listIndex];
+        for (size_t i = 0; i < items.size(); ++i) {
+            Element* item = items[i];
+            if (item->hasLocalName(optionTag) && optionIndex++ >= newLen) {
                 ASSERT(item->parentNode());
+                itemsToRemove.append(item);
+            }
+        }
+
+        for (size_t i = 0; i < itemsToRemove.size(); ++i) {
+            Element* item = itemsToRemove[i].get();
+            if (item->parentNode()) {
                 item->parentNode()->removeChild(item, ec);
             }
         }

-- 
WebKit Debian packaging



More information about the Pkg-webkit-commits mailing list