Reviewed by Dimitri Glazkov.
Convert raw ptr to RefPtr for documentElement.
https://bugs.webkit.org/show_bug.cgi?id=61688
Test: fast/dom/xml-parser-error-message-crash.svg
* dom/XMLDocumentParser.cpp:
(WebCore::XMLDocumentParser::insertErrorMessageBlock):
2011-05-31 Abhishek Arya <inferno@chromium.org>
Reviewed by Dimitri Glazkov.
Test that we do not crash when a DOMNodeInsertedIntoDocument event
is fired while generating a error message block in xml parsing.
https://bugs.webkit.org/show_bug.cgi?id=61688
* fast/dom/xml-parser-error-message-crash-expected.txt: Added.
* fast/dom/xml-parser-error-message-crash.svg: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@87737
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2011-05-31 Abhishek Arya <inferno@chromium.org>
+
+ Reviewed by Dimitri Glazkov.
+
+ Test that we do not crash when a DOMNodeInsertedIntoDocument event
+ is fired while generating a error message block in xml parsing.
+ https://bugs.webkit.org/show_bug.cgi?id=61688
+
+ * fast/dom/xml-parser-error-message-crash-expected.txt: Added.
+ * fast/dom/xml-parser-error-message-crash.svg: Added.
+
2011-05-31 Andreas Kling <kling@webkit.org>
Reviewed by Antti Koivisto.
--- /dev/null
+<svg xmlns="http://www.w3.org/2000/svg">\r
+<script>\r
+if (window.layoutTestController)\r
+ layoutTestController.dumpAsText();\r
+\r
+function runTest()\r
+{\r
+ document.firstChild.innerHTML = "PASS";\r
+}\r
+\r
+document.addEventListener("DOMNodeInsertedIntoDocument", runTest, true);\r
+</script>\r
+\r
+2011-05-31 Abhishek Arya <inferno@chromium.org>
+
+ Reviewed by Dimitri Glazkov.
+
+ Convert raw ptr to RefPtr for documentElement.
+ https://bugs.webkit.org/show_bug.cgi?id=61688
+
+ Test: fast/dom/xml-parser-error-message-crash.svg
+
+ * dom/XMLDocumentParser.cpp:
+ (WebCore::XMLDocumentParser::insertErrorMessageBlock):
+
2011-05-31 Andreas Kling <kling@webkit.org>
Reviewed by Antti Koivisto.
// Create elements for display
ExceptionCode ec = 0;
Document* document = this->document();
- Element* documentElement = document->documentElement();
+ RefPtr<Element> documentElement = document->documentElement();
if (!documentElement) {
RefPtr<Element> rootElement = document->createElement(htmlTag, false);
document->appendChild(rootElement, ec);