[SCM] WebKit Debian packaging branch, debian/experimental, updated. debian/1.3.8-1-1049-g2e11a8e
tonyg at chromium.org
tonyg at chromium.org
Fri Jan 21 14:46:05 UTC 2011
The following commit has been merged in the debian/experimental branch:
commit 79288bcd05edaa2aa5308133ccb6ef9fe021be41
Author: tonyg at chromium.org <tonyg at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Wed Dec 29 20:39:58 2010 +0000
2010-12-29 Tony Gentilcore <tonyg at chromium.org>
Reviewed by Eric Seidel.
Assertion failure: element->inDocument() in AsyncScriptRunner::executeScriptSoon()
https://bugs.webkit.org/show_bug.cgi?id=51067
* fast/dom/HTMLScriptElement/move-in-beforeload-expected.txt: Added.
* fast/dom/HTMLScriptElement/move-in-beforeload.html: Added.
* fast/dom/HTMLScriptElement/remove-in-beforeload-expected.txt: Added.
* fast/dom/HTMLScriptElement/remove-in-beforeload.html: Added.
2010-12-29 Tony Gentilcore <tonyg at chromium.org>
Reviewed by Eric Seidel.
Assertion failure: element->inDocument() in AsyncScriptRunner::executeScriptSoon()
https://bugs.webkit.org/show_bug.cgi?id=51067
Typically when a script element is removed from the document, the cached script
client is removed. However, during the before load event, the cached script client
hasn't been created yet so it can't be removed.
This patch handles that case by explicitly checking if the script element was
removed during the beforeload event. Also, it avoids caching the Document references
over the arbitrary script execution in the before load event.
Test: fast/dom/HTMLScriptElement/move-in-beforeload.html
fast/dom/HTMLScriptElement/remove-in-beforeload.html
* dom/ScriptElement.cpp:
(WebCore::ScriptElement::requestScript):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@74752 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 427c2e4..8272f9b 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2010-12-29 Tony Gentilcore <tonyg at chromium.org>
+
+ Reviewed by Eric Seidel.
+
+ Assertion failure: element->inDocument() in AsyncScriptRunner::executeScriptSoon()
+ https://bugs.webkit.org/show_bug.cgi?id=51067
+
+ * fast/dom/HTMLScriptElement/move-in-beforeload-expected.txt: Added.
+ * fast/dom/HTMLScriptElement/move-in-beforeload.html: Added.
+ * fast/dom/HTMLScriptElement/remove-in-beforeload-expected.txt: Added.
+ * fast/dom/HTMLScriptElement/remove-in-beforeload.html: Added.
+
2010-12-29 Mihai Parparita <mihaip at chromium.org>
Unreviewed, rolling out r74748.
diff --git a/LayoutTests/fast/dom/HTMLScriptElement/move-in-beforeload-expected.txt b/LayoutTests/fast/dom/HTMLScriptElement/move-in-beforeload-expected.txt
new file mode 100644
index 0000000..af65951
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLScriptElement/move-in-beforeload-expected.txt
@@ -0,0 +1,2 @@
+PASS
+
diff --git a/LayoutTests/fast/dom/HTMLScriptElement/move-in-beforeload.html b/LayoutTests/fast/dom/HTMLScriptElement/move-in-beforeload.html
new file mode 100644
index 0000000..77beed0
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLScriptElement/move-in-beforeload.html
@@ -0,0 +1,35 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css">
+<script src="../../js/resources/js-test-pre.js"></script>
+<body onload="test()">
+<div id="console"></div>
+<iframe src="resources/frame.html"></iframe>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+}
+
+function test()
+{
+ var s = document.createElement("script");
+ s.addEventListener("beforeload", function() {
+ var s = document.body.removeChild(document.getElementsByTagName("script")[2]);
+ document.getElementsByTagName("iframe")[0].contentDocument.body.appendChild(s);
+ }, false);
+ s.addEventListener("error", function() {
+ testFailed("error event should not fire.")
+ }, false);
+ s.addEventListener("load", function() {
+ testPassed("");
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }, false);
+ s.src = "external.js";
+ document.body.appendChild(s);
+}
+</script>
+</body>
+</html>
diff --git a/LayoutTests/fast/dom/HTMLScriptElement/remove-in-beforeload-expected.txt b/LayoutTests/fast/dom/HTMLScriptElement/remove-in-beforeload-expected.txt
new file mode 100644
index 0000000..af65951
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLScriptElement/remove-in-beforeload-expected.txt
@@ -0,0 +1,2 @@
+PASS
+
diff --git a/LayoutTests/fast/dom/HTMLScriptElement/remove-in-beforeload.html b/LayoutTests/fast/dom/HTMLScriptElement/remove-in-beforeload.html
new file mode 100644
index 0000000..1c34060
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLScriptElement/remove-in-beforeload.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css">
+<script src="../../js/resources/js-test-pre.js"></script>
+<body onload="test()">
+<div id="console"></div>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+}
+
+function test()
+{
+ var s = document.createElement("script");
+ s.addEventListener("beforeload", function() {
+ document.body.removeChild(document.getElementsByTagName("script")[2]);
+ testPassed("");
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }, false);
+ s.addEventListener("error", function() {
+ testFailed("error event should not fire.")
+ }, false);
+ s.addEventListener("load", function() {
+ testFailed("load event should not fire.")
+ }, false);
+ s.src = "resources/shouldnotexecute.js";
+ document.body.appendChild(s);
+}
+</script>
+</body>
+</html>
diff --git a/LayoutTests/fast/dom/HTMLScriptElement/resources/frame.html b/LayoutTests/fast/dom/HTMLScriptElement/resources/frame.html
new file mode 100644
index 0000000..9399019
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLScriptElement/resources/frame.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../../js/resources/js-test-style.css">
+<script src="../../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<div id="console"></div>
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index fef3b45..61a7927 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,24 @@
+2010-12-29 Tony Gentilcore <tonyg at chromium.org>
+
+ Reviewed by Eric Seidel.
+
+ Assertion failure: element->inDocument() in AsyncScriptRunner::executeScriptSoon()
+ https://bugs.webkit.org/show_bug.cgi?id=51067
+
+ Typically when a script element is removed from the document, the cached script
+ client is removed. However, during the before load event, the cached script client
+ hasn't been created yet so it can't be removed.
+
+ This patch handles that case by explicitly checking if the script element was
+ removed during the beforeload event. Also, it avoids caching the Document references
+ over the arbitrary script execution in the before load event.
+
+ Test: fast/dom/HTMLScriptElement/move-in-beforeload.html
+ fast/dom/HTMLScriptElement/remove-in-beforeload.html
+
+ * dom/ScriptElement.cpp:
+ (WebCore::ScriptElement::requestScript):
+
2010-12-29 Alexander Pavlov <apavlov at chromium.org>
Reviewed by Yury Semikhatsky.
diff --git a/WebCore/dom/ScriptElement.cpp b/WebCore/dom/ScriptElement.cpp
index 74f2580..747f7a1 100644
--- a/WebCore/dom/ScriptElement.cpp
+++ b/WebCore/dom/ScriptElement.cpp
@@ -145,19 +145,20 @@ static bool isSupportedJavaScriptLanguage(const String& language)
void ScriptElement::requestScript(const String& sourceUrl)
{
- Document* document = m_element->document();
-
// FIXME: Eventually we'd like to evaluate scripts which are inserted into a
// viewless document but this'll do for now.
// See http://bugs.webkit.org/show_bug.cgi?id=5727
- if (!document->frame())
+ if (!m_element->document()->frame())
return;
+ RefPtr<Document> originalDocument = m_element->document();
if (!m_element->dispatchBeforeLoadEvent(sourceUrl))
return;
+ if (!m_element->inDocument() || m_element->document() != originalDocument)
+ return;
ASSERT(!m_cachedScript);
- m_cachedScript = document->cachedResourceLoader()->requestScript(sourceUrl, scriptCharset());
+ m_cachedScript = m_element->document()->cachedResourceLoader()->requestScript(sourceUrl, scriptCharset());
m_isExternalScript = true;
// m_wasInsertedByParser is never reset - always resied at the initial value set while parsing.
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list