REGRESSION(r104210): Crash inside DynamicSubtreeNodeList::length
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 7 Jan 2012 09:12:01 +0000 (09:12 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 7 Jan 2012 09:12:01 +0000 (09:12 +0000)
commitc0e103da78079769eeeb13a0adad52ddeaad5e8c
treee6778d693642ec032eeb9684720862f237fa89dc
parent13601f1bb8277fdf8e25dad9221bb1083b80989a
REGRESSION(r104210): Crash inside DynamicSubtreeNodeList::length
https://bugs.webkit.org/show_bug.cgi?id=75731

Reviewed by Andreas Kling.

Source/WebCore:

The crash was caused by DynamicSubtreeNodeList::SubtreeCaches::domVersionIsConsistent
using m_cachedItem as a way to access the document. Changed SubtreeCaches to use
DynamicSubtreeNodeList's m_node instead.

Test: fast/dom/node-list-length-after-removing-node.html

* dom/DynamicNodeList.cpp:
(WebCore::DynamicSubtreeNodeList::SubtreeCaches::setLengthCache):
(WebCore::DynamicSubtreeNodeList::SubtreeCaches::setItemCache):
(WebCore::DynamicSubtreeNodeList::length):
(WebCore::DynamicSubtreeNodeList::item):
* dom/DynamicNodeList.h:
(WebCore::DynamicSubtreeNodeList::SubtreeCaches::isLengthCacheValid):
(WebCore::DynamicSubtreeNodeList::SubtreeCaches::isItemCacheValid):
(WebCore::DynamicSubtreeNodeList::SubtreeCaches::cachedItem):
(WebCore::DynamicSubtreeNodeList::SubtreeCaches::domVersionIsConsistent):

LayoutTests:

Add a regression test. It reproduces the crash with a very high probability.

* fast/dom/node-list-length-after-removing-node-expected.txt: Added.
* fast/dom/node-list-length-after-removing-node.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@104381 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/dom/node-list-length-after-removing-node-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/node-list-length-after-removing-node.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/dom/DynamicNodeList.cpp
Source/WebCore/dom/DynamicNodeList.h