Source/WebCore: ASSERT(!eventDispatchForbidden()) fires when removed plugin re-insert...
authortsepez@chromium.org <tsepez@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 13 Sep 2012 23:12:03 +0000 (23:12 +0000)
committertsepez@chromium.org <tsepez@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 13 Sep 2012 23:12:03 +0000 (23:12 +0000)
commitca6f35b5f87a8b92ba6e368e3cc2debd4b6d3ab2
tree5a615a0a475215bf532271b3a8ac25cf5f53cab8
parentf1e24ca3f6a94b62f8fd591bb9a849cb15303c95
Source/WebCore: ASSERT(!eventDispatchForbidden()) fires when removed plugin re-inserted as part of readyStateChange.
https://bugs.webkit.org/show_bug.cgi?id=93639

Reviewed by Ryosuke Niwa.

Removing a plugin causes a detach which can cancel the last remaining load on a page,
resulting in a readyStateChange event during a time when things are inconsisent. Defer
the detach which triggers this chain of events until after the node is fully removed
from the document's elementsById map.

Test: plugins/plugin-remove-readystatechange.html

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::removeChild):
(WebCore::ContainerNode::removeChildren):

LayoutTests: ASSERT(!eventDispatchForbidden()) firest when removed plugin re-inserted as part of readyStateChange.
https://bugs.webkit.org/show_bug.cgi?id=93639

Reviewed by Ryosuke Niwa.

Add a new testcase to cover this issue.  Test passes if assert doesn't fire in debug builds.

* plugins/plugin-remove-readystatechange-expected.txt: Added.
* plugins/plugin-remove-readystatechange.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@128524 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/plugins/plugin-remove-readystatechange-expected.txt [new file with mode: 0644]
LayoutTests/plugins/plugin-remove-readystatechange.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/dom/ContainerNode.cpp