Regression(r189881): release assertion hit in toJS(ExecState*, JSDOMGlobalObject...
authorcdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 18 Sep 2015 00:46:12 +0000 (00:46 +0000)
committercdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 18 Sep 2015 00:46:12 +0000 (00:46 +0000)
commitc3df164107904f9e7056786fc477fd2cefed824e
treed3d6e8c888adf6db281aaa69b67e3d3bd92ab279
parentf113f44660498711be9255724cc1ab639b6e3648
Regression(r189881): release assertion hit in toJS(ExecState*, JSDOMGlobalObject*, DocumentFragment*)
https://bugs.webkit.org/show_bug.cgi?id=149281

Reviewed by Ryosuke Niwa.

After r189881, we started generating a toJS() function for DocumentFragment
as an optimization. DocumentFragment has a subclass (ShadowRoot) but the
default toJS() implementation should have still been acceptable given that
the subclass is not web-exposed and therefore does not have a JS wrapper.

However, the ShadowRoot interface was introduced shortly after in r189841
and to toJS() implementation for DocumentFragment is now invalid. This
patch introduces a ShadowRoot-aware custom implementation of toJS() for
DocumentFragment to address the problem.

No new tests, already covered by:
plugins/snapshotting/snapshot-plugin-not-quite-blocked-by-image.html

* bindings/js/JSDocumentFragmentCustom.cpp:
(WebCore::createNewDocumentFragmentWrapper):
(WebCore::toJSNewlyCreated):
(WebCore::toJS):
Provide a ShadowRoot-aware custom implementation of toJS() /
toJSNewlyCreated() for DocumentFragment.

* bindings/js/JSNodeCustom.cpp:
(WebCore::createWrapperInline):
Fix bug in toJS() implementation for Node as it was not handling
ShadowRoots properly either.

* dom/DocumentFragment.idl:
Use [CustomToJSObject] so we can provide our own custom implementation
of toJS().

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@189949 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore/ChangeLog
Source/WebCore/bindings/js/JSDocumentFragmentCustom.cpp
Source/WebCore/bindings/js/JSNodeCustom.cpp
Source/WebCore/dom/DocumentFragment.idl