[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

Wed Dec 22 15:47:55 UTC 2010

The following commit has been merged in the debian/experimental branch:
commit 7d96bb5fb80694aee110e38df6ea62c3a600f5b1
Author: jschuh at chromium.org <jschuh at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Fri Nov 12 16:55:26 2010 +0000

    2010-11-12  Justin Schuh  <jschuh at chromium.org>
    
            Reviewed by Adam Barth.
    
            Use a RefPtr inside ContainerNode::willRemove loop
            https://bugs.webkit.org/show_bug.cgi?id=49237
    
            Test: fast/innerHTML/innerHTML-iframe.html
    
            * dom/ContainerNode.cpp:
            (WebCore::ContainerNode::willRemove):
    2010-11-12  Justin Schuh  <jschuh at chromium.org>
    
            Reviewed by Adam Barth.
    
            Use a RefPtr inside ContainerNode::willRemove loop
            https://bugs.webkit.org/show_bug.cgi?id=49237
    
            * fast/innerHTML/innerHTML-iframe-expected.txt: Added.
            * fast/innerHTML/innerHTML-iframe.html: Added.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@71918 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 951aab7..eec7877 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-11-12  Justin Schuh  <jschuh at chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Use a RefPtr inside ContainerNode::willRemove loop
+        https://bugs.webkit.org/show_bug.cgi?id=49237
+
+        * fast/innerHTML/innerHTML-iframe-expected.txt: Added.
+        * fast/innerHTML/innerHTML-iframe.html: Added.
+
 2010-11-12  Yael Aharon  <yael.aharon at nokia.com>
 
         Reviewed by Antonio Gomes.
diff --git a/LayoutTests/fast/innerHTML/innerHTML-iframe-expected.txt b/LayoutTests/fast/innerHTML/innerHTML-iframe-expected.txt
new file mode 100644
index 0000000..1c75c85
--- /dev/null
+++ b/LayoutTests/fast/innerHTML/innerHTML-iframe-expected.txt
@@ -0,0 +1 @@
+PASS: body and iframe cleared without crashing.
diff --git a/LayoutTests/fast/innerHTML/innerHTML-iframe.html b/LayoutTests/fast/innerHTML/innerHTML-iframe.html
new file mode 100644
index 0000000..a4a8343
--- /dev/null
+++ b/LayoutTests/fast/innerHTML/innerHTML-iframe.html
@@ -0,0 +1,16 @@
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+setTimeout(function(){
+        document.body.innerHTML = "<b>PASS:</b> body and iframe cleared without crashing.";
+        layoutTestController.notifyDone();
+    }, 0);
+</script>
+<body onload='document.getElementById("x").innerHTML = 1'>
+  <div id="x">
+    <iframe src="does-not-exist">
+  </div>
+</body>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 32aaa41..3a7e9a4 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-11-12  Justin Schuh  <jschuh at chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Use a RefPtr inside ContainerNode::willRemove loop
+        https://bugs.webkit.org/show_bug.cgi?id=49237
+
+        Test: fast/innerHTML/innerHTML-iframe.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::willRemove):
+
 2010-11-12  Pavel Feldman  <pfeldman at chromium.org>
 
         Reviewed by Yury Semikhatsky.
diff --git a/WebCore/dom/ContainerNode.cpp b/WebCore/dom/ContainerNode.cpp
index 294d0fe..cd16e01 100644
--- a/WebCore/dom/ContainerNode.cpp
+++ b/WebCore/dom/ContainerNode.cpp
@@ -355,8 +355,11 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
 
 void ContainerNode::willRemove()
 {
-    for (Node *n = m_firstChild; n != 0; n = n->nextSibling())
-        n->willRemove();
+    NodeVector nodes;
+    for (Node* n = m_lastChild; n; n = n->previousSibling())
+        nodes.append(n);
+    for (; nodes.size(); nodes.removeLast())
+        nodes.last().get()->willRemove();
     Node::willRemove();
 }
 

-- 
WebKit Debian packaging

