REGRESSION(r134408): Heap-use-after-free in WebCore::HTMLConstructionSite::mergeAttri...
authorkling@webkit.org <kling@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 15 Nov 2012 16:35:30 +0000 (16:35 +0000)
committerkling@webkit.org <kling@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 15 Nov 2012 16:35:30 +0000 (16:35 +0000)
commit0a46d1fb06ceb15b25e26aec62f8a35b40ccd1f5
treec187a5ec28ba2cc36f447b7a5be6ad11d64bcd6b
parent109cc0ac18b58198aed77aadee4340549933cb5f
REGRESSION(r134408): Heap-use-after-free in WebCore::HTMLConstructionSite::mergeAttributesFromTokenIntoElement().
<http://webkit.org/b/102304>

Reviewed by Anders Carlsson.

Source/WebCore:

Test: fast/dom/cloneNode-below-body-attribute-merging.html

* html/parser/HTMLConstructionSite.cpp:
(WebCore::HTMLConstructionSite::mergeAttributesFromTokenIntoElement):

    Use Element::fastHasAttribute() to determine if a given attribute is already present on the element
    we're merging attributes into.

* dom/ElementAttributeData.h:
(ElementAttributeData):

    Remove a now-unnecessary friend declaration.

LayoutTests:

* fast/dom/cloneNode-below-body-attribute-merging-expected.txt: Added.
* fast/dom/cloneNode-below-body-attribute-merging.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@134779 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/dom/cloneNode-below-body-attribute-merging-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/cloneNode-below-body-attribute-merging.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/dom/ElementAttributeData.h
Source/WebCore/html/parser/HTMLConstructionSite.cpp