2010-07-14 Adam Barth <abarth@webkit.org>
authorabarth@webkit.org <abarth@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 15 Jul 2010 02:40:22 +0000 (02:40 +0000)
committerabarth@webkit.org <abarth@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 15 Jul 2010 02:40:22 +0000 (02:40 +0000)
        Reviewed by Eric Seidel.

        HTMLTreeBuilder shouldn't crash during fast/parser/remove-parser-current-node.html
        https://bugs.webkit.org/show_bug.cgi?id=42312

        We were crashing because of an ASSERT I added to the attach logic in
        the HTMLConstructionSite.  I knew this ASSERT was wrong when I added
        it, I just wanted to make sure we had test coverage of those cases.
        Turns out we do!  :)

        * html/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::attach):
        (WebCore::HTMLConstructionSite::attachAtSite):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@63393 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore/ChangeLog
WebCore/html/HTMLConstructionSite.cpp

index 168c566..3d3db7d 100644 (file)
@@ -1,3 +1,19 @@
+2010-07-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        HTMLTreeBuilder shouldn't crash during fast/parser/remove-parser-current-node.html
+        https://bugs.webkit.org/show_bug.cgi?id=42312
+
+        We were crashing because of an ASSERT I added to the attach logic in
+        the HTMLConstructionSite.  I knew this ASSERT was wrong when I added
+        it, I just wanted to make sure we had test coverage of those cases.
+        Turns out we do!  :)
+
+        * html/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::attach):
+        (WebCore::HTMLConstructionSite::attachAtSite):
+
 2010-07-14  Victor Wang  <victorw@chromium.org>
 
         Reviewed by Darin Fisher.
index 754c118..11dea00 100644 (file)
@@ -101,9 +101,10 @@ PassRefPtr<ChildType> HTMLConstructionSite::attach(Node* parent, PassRefPtr<Chil
     // |parent| to hold a ref at this point.  In the common case (at least
     // for elements), however, we'll get to use this ref in the stack of
     // open elements.
-    ASSERT(parent->attached());
-    ASSERT(!child->attached());
-    child->attach();
+    if (parent->attached()) {
+        ASSERT(!child->attached());
+        child->attach();
+    }
     return child.release();
 }
 
@@ -116,8 +117,7 @@ void HTMLConstructionSite::attachAtSite(const AttachmentSite& site, PassRefPtr<N
         ExceptionCode ec = 0;
         site.parent->insertBefore(child, site.nextChild, ec);
         ASSERT(!ec);
-        ASSERT(site.parent->attached());
-        if (!child->attached())
+        if (site.parent->attached() && !child->attached())
             child->attach();
         return;
     }
@@ -125,8 +125,7 @@ void HTMLConstructionSite::attachAtSite(const AttachmentSite& site, PassRefPtr<N
     // It's slightly unfortunate that we need to hold a reference to child
     // here to call attach().  We should investigate whether we can rely on
     // |site.parent| to hold a ref at this point.
-    ASSERT(site.parent->attached());
-    if (!child->attached())
+    if (site.parent->attached() && !child->attached())
         child->attach();
 }