[SCM] WebKit Debian packaging branch, webkit-1.3, updated. upstream/1.3.7-4207-g178b198

[morrita at google.com]

The following commit has been merged in the webkit-1.3 branch:
commit d75075ca0f3babd3a22c06d4b420c70f233b3758
Author: morrita at google.com <morrita at google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Thu Jan 20 01:24:40 2011 +0000

    2011-01-18 MORITA Hajime <morrita at google.com>
    
            Reviewed by David Levin.
    
            ElementRareData::m_shadowRoot should not be RefPtr.
            https://bugs.webkit.org/show_bug.cgi?id=51914
    
            Makes ElementRareData::m_shadowRoot a raw pointer because
            ElementRareData::m_shadowRoot should be like a
            ContaineNode::m_firstChild, which is also a raw pointer.
            pointer. Which also means that both the shadow root and the shadow
            host reference each other as a parent-and-child relationship, via
            a raw pointer.
    
            Note that it is safe not to manipulate the ref-count of
            m_shadowRoot because Node::m_parent of the shadow root points its
            shadow host, and the object isn't deleted even if the refcount is
            zero, as long as the node has non-null m_parent. (See TreeShared.)
    
            The shadow root node is finally destroyed inside
            removeShadowRoot(), where we store the root node into a local
            RefPtr, then make the node's m_parent null, which results the
            destroy the node, at the end of the function, by RefPtr::~RefPtr.
    
            No new tests. No behavioral change.
    
            * dom/Element.cpp:
            (WebCore::Element::~Element):
            (WebCore::Element::shadowRoot):
            (WebCore::Element::setShadowRoot):
            (WebCore::Element::removeShadowRoot):
            * dom/ElementRareData.h:
            (WebCore::ElementRareData::ElementRareData):
            (WebCore::ElementRareData::~ElementRareData):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76183 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index b9e45a6..bd91d1a 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,38 @@
+2011-01-18 MORITA Hajime <morrita at google.com>
+
+        Reviewed by David Levin.
+
+        ElementRareData::m_shadowRoot should not be RefPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=51914
+
+        Makes ElementRareData::m_shadowRoot a raw pointer because
+        ElementRareData::m_shadowRoot should be like a
+        ContaineNode::m_firstChild, which is also a raw pointer.
+        pointer. Which also means that both the shadow root and the shadow
+        host reference each other as a parent-and-child relationship, via
+        a raw pointer.
+        
+        Note that it is safe not to manipulate the ref-count of
+        m_shadowRoot because Node::m_parent of the shadow root points its
+        shadow host, and the object isn't deleted even if the refcount is
+        zero, as long as the node has non-null m_parent. (See TreeShared.)
+        
+        The shadow root node is finally destroyed inside
+        removeShadowRoot(), where we store the root node into a local
+        RefPtr, then make the node's m_parent null, which results the
+        destroy the node, at the end of the function, by RefPtr::~RefPtr.
+        
+        No new tests. No behavioral change.
+
+        * dom/Element.cpp:
+        (WebCore::Element::~Element):
+        (WebCore::Element::shadowRoot):
+        (WebCore::Element::setShadowRoot):
+        (WebCore::Element::removeShadowRoot):
+        * dom/ElementRareData.h:
+        (WebCore::ElementRareData::ElementRareData):
+        (WebCore::ElementRareData::~ElementRareData):
+
 2011-01-12  Martin Robinson  <mrobinson at igalia.com>
 
         Reviewed by Gustavo Noronha Silva.
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index c61b95d..c62ae49 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -75,6 +75,7 @@ PassRefPtr<Element> Element::create(const QualifiedName& tagName, Document* docu
 
 Element::~Element()
 {
+    removeShadowRoot();
     if (m_attributeMap)
         m_attributeMap->detachFromElement();
 }
@@ -1084,7 +1085,7 @@ void Element::recalcStyle(StyleChange change)
 
 Node* Element::shadowRoot()
 {
-    return hasRareData() ? rareData()->m_shadowRoot.get() : 0;
+    return hasRareData() ? rareData()->m_shadowRoot : 0;
 }
 
 void Element::setShadowRoot(PassRefPtr<Node> node)
@@ -1093,11 +1094,12 @@ void Element::setShadowRoot(PassRefPtr<Node> node)
     // about compromising DOM tree integrity (eg. node being a parent of this). However,
     // once we implement XBL2, we will have to add integrity checks here.
     removeShadowRoot();
+
     RefPtr<Node> newRoot = node;
     if (!newRoot)
         return;
 
-    ensureRareData()->m_shadowRoot = newRoot;
+    ensureRareData()->m_shadowRoot = newRoot.get();
     newRoot->setShadowHost(this);
 }
 
@@ -1106,7 +1108,9 @@ void Element::removeShadowRoot()
     if (!hasRareData())
         return;
 
-    if (RefPtr<Node> oldRoot = rareData()->m_shadowRoot.release()) {
+    ElementRareData* data = rareData();
+    if (RefPtr<Node> oldRoot = data->m_shadowRoot) {
+        data->m_shadowRoot = 0;
         document()->removeFocusedNodeOfSubtree(oldRoot.get());
         oldRoot->setShadowHost(0);
         if (oldRoot->inDocument())
diff --git a/Source/WebCore/dom/ElementRareData.h b/Source/WebCore/dom/ElementRareData.h
index f7f30bb..818a2c2 100644
--- a/Source/WebCore/dom/ElementRareData.h
+++ b/Source/WebCore/dom/ElementRareData.h
@@ -33,6 +33,7 @@ namespace WebCore {
 class ElementRareData : public NodeRareData {
 public:
     ElementRareData();
+    virtual ~ElementRareData();
 
     void resetComputedStyle();
 
@@ -41,7 +42,7 @@ public:
 
     IntSize m_minimumSizeForResizing;
     RefPtr<RenderStyle> m_computedStyle;
-    RefPtr<Node> m_shadowRoot;
+    Node* m_shadowRoot;
 
     OwnPtr<DatasetDOMStringMap> m_datasetDOMStringMap;
     OwnPtr<ClassList> m_classList;
@@ -54,9 +55,15 @@ inline IntSize defaultMinimumSizeForResizing()
 
 inline ElementRareData::ElementRareData()
     : m_minimumSizeForResizing(defaultMinimumSizeForResizing())
+    , m_shadowRoot(0)
 {
 }
 
+inline ElementRareData::~ElementRareData()
+{
+    ASSERT(!m_shadowRoot);
+}
+
 inline void ElementRareData::resetComputedStyle()
 {
     m_computedStyle.clear();

-- 
WebKit Debian packaging