2006-04-24 Eric Seidel <eseidel@apple.com>
authoreseidel <eseidel@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 25 Apr 2006 05:24:21 +0000 (05:24 +0000)
committereseidel <eseidel@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 25 Apr 2006 05:24:21 +0000 (05:24 +0000)
        Reviewed by ggaren.

        Fix for 5th worst unresolved crasher:
        <rdar://problem/4129744> [REGRESSION]CrashTracer: ..400 crashes at com.apple.WebCore: DOM::NodeImpl::createRendererIfNeeded + 44

        Test: fast/dom/remove-style-element.html

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::removeChildren):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@14045 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/dom/remove-style-element-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/remove-style-element.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/dom/ContainerNode.cpp

index 83c10bdae2e1c8c7c3afa44eb0fc2f88bbfaa012..ec6f5252f0daebf8c14b4411f43fcfebf09963ac 100644 (file)
@@ -1,3 +1,12 @@
+2006-04-24  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by ggaren.
+
+        <rdar://problem/4129744> [REGRESSION]CrashTracer: ..400 crashes at com.apple.WebCore: DOM::NodeImpl::createRendererIfNeeded + 44
+
+        * fast/dom/remove-style-element-expected.txt: Added.
+        * fast/dom/remove-style-element.html: Added.
+
 2006-04-23  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Maciej.
diff --git a/LayoutTests/fast/dom/remove-style-element-expected.txt b/LayoutTests/fast/dom/remove-style-element-expected.txt
new file mode 100644 (file)
index 0000000..1cd4488
--- /dev/null
@@ -0,0 +1,3 @@
+SUCCESS (you didn't crash!)
+
+
diff --git a/LayoutTests/fast/dom/remove-style-element.html b/LayoutTests/fast/dom/remove-style-element.html
new file mode 100644 (file)
index 0000000..00acacd
--- /dev/null
@@ -0,0 +1,11 @@
+<div id="content"></div>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var content = document.getElementById("content");
+document.getElementById("content").innerHTML = "<style>text</style>";
+content.style.display = "none";
+content.innerHTML = '';
+</script>
+<p>SUCCESS (you didn't crash!)</p>
index a24d9cbea89504d071575ced40bde4a6d3a34f60..8bd03f5d7fbe906214f00e7fef6aa2536185666f 100644 (file)
@@ -1,3 +1,15 @@
+2006-04-24  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by ggaren.
+
+        Fix for 5th worst unresolved crasher:
+        <rdar://problem/4129744> [REGRESSION]CrashTracer: ..400 crashes at com.apple.WebCore: DOM::NodeImpl::createRendererIfNeeded + 44
+
+        Test: fast/dom/remove-style-element.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren):
+
 2006-04-24  Eric Seidel  <eseidel@apple.com>
 
         Reviewed by mjs.
index b0297b4003867b67bd11c86849ab25d3e113df31..870b3f5061052c417bda411afa5c0b7635693eff 100644 (file)
@@ -448,14 +448,15 @@ void ContainerNode::removeChildren()
         n->setNextSibling(0);
         n->setParent(0);
         
+        m_firstChild = next;
+        if (n == m_lastChild)
+            m_lastChild = 0;
+        
         if (n->inDocument())
             n->removedFromDocument();
 
         n->deref();
-
-        m_firstChild = next;
     }
-    m_lastChild = 0;
     allowEventDispatch();
     
     // Dispatch a single post-removal mutation event denoting a modified subtree.