CounterMaps should hold a unique_ptr of CounterMap.
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 31 Aug 2018 04:27:44 +0000 (04:27 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 31 Aug 2018 04:27:44 +0000 (04:27 +0000)
commitc74bab9c1b7f3f875b0ac289347003e69ea345f2
treedb2f16a108ddc03f5dac9387a5866203115e5172
parent61a95c2e63ebb03a172f7127626414985640ec7f
CounterMaps should hold a unique_ptr of CounterMap.
https://bugs.webkit.org/show_bug.cgi?id=189174
<rdar://problem/43686458>

Reviewed by Ryosuke Niwa.

Source/WebCore:

In certain cases calls to CounterMaps might lead to unexpected deletion of the CounterMap object.

Test: fast/css/counters/crash-when-cloning-body.html

* rendering/RenderCounter.cpp:
(WebCore::makeCounterNode):
(WebCore::destroyCounterNodeWithoutMapRemoval):
(WebCore::RenderCounter::destroyCounterNodes):
(WebCore::RenderCounter::destroyCounterNode):
(WebCore::updateCounters):
(showCounterRendererTree):

LayoutTests:

* fast/css/counters/crash-when-cloning-body-expected.txt: Added.
* fast/css/counters/crash-when-cloning-body.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@235537 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/css/counters/crash-when-cloning-body-expected.txt [new file with mode: 0644]
LayoutTests/fast/css/counters/crash-when-cloning-body.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderCounter.cpp