2011-05-31 Abhishek Arya <inferno@chromium.org>

        Reviewed by Dimitri Glazkov.

        Convert raw ptr to RefPtr for documentElement.
        https://bugs.webkit.org/show_bug.cgi?id=61688

        Test: fast/dom/xml-parser-error-message-crash.svg

        * dom/XMLDocumentParser.cpp:
        (WebCore::XMLDocumentParser::insertErrorMessageBlock):
2011-05-31  Abhishek Arya  <inferno@chromium.org>

        Reviewed by Dimitri Glazkov.

        Test that we do not crash when a DOMNodeInsertedIntoDocument event
        is fired while generating a error message block in xml parsing.
        https://bugs.webkit.org/show_bug.cgi?id=61688

        * fast/dom/xml-parser-error-message-crash-expected.txt: Added.
        * fast/dom/xml-parser-error-message-crash.svg: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@87737 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index dee2b2f598071729b46c49d9b8ba590fb13dadc9..e09adeae637816b1312f0ee3904e3b3669412a18 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2011-05-31  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Test that we do not crash when a DOMNodeInsertedIntoDocument event
+        is fired while generating a error message block in xml parsing.
+        https://bugs.webkit.org/show_bug.cgi?id=61688
+
+        * fast/dom/xml-parser-error-message-crash-expected.txt: Added.
+        * fast/dom/xml-parser-error-message-crash.svg: Added.
+
 2011-05-31  Andreas Kling  <kling@webkit.org>
 
         Reviewed by Antti Koivisto.

diff --git a/LayoutTests/fast/dom/xml-parser-error-message-crash-expected.txt b/LayoutTests/fast/dom/xml-parser-error-message-crash-expected.txt
new file mode 100644 (file)
index 0000000..7ef22e9
--- /dev/null
+++ b/LayoutTests/fast/dom/xml-parser-error-message-crash-expected.txt
@@ -0,0 +1 @@
+PASS

diff --git a/LayoutTests/fast/dom/xml-parser-error-message-crash.svg b/LayoutTests/fast/dom/xml-parser-error-message-crash.svg
new file mode 100644 (file)
index 0000000..467710e
--- /dev/null
+++ b/LayoutTests/fast/dom/xml-parser-error-message-crash.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">\r
+<script>\r
+if (window.layoutTestController)\r
+    layoutTestController.dumpAsText();\r
+\r
+function runTest()\r
+{\r
+    document.firstChild.innerHTML = "PASS";\r
+}\r
+\r
+document.addEventListener("DOMNodeInsertedIntoDocument", runTest, true);\r
+</script>\r
+\r

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index ca66596f89220f8699967417e199ff6597048f9f..3069b9f0ffc9960ede831308b697e1055d112b92 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2011-05-31  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Convert raw ptr to RefPtr for documentElement.
+        https://bugs.webkit.org/show_bug.cgi?id=61688
+
+        Test: fast/dom/xml-parser-error-message-crash.svg
+
+        * dom/XMLDocumentParser.cpp:
+        (WebCore::XMLDocumentParser::insertErrorMessageBlock):
+
 2011-05-31  Andreas Kling  <kling@webkit.org>
 
         Reviewed by Antti Koivisto.

diff --git a/Source/WebCore/dom/XMLDocumentParser.cpp b/Source/WebCore/dom/XMLDocumentParser.cpp
index 6d8094fe0c650d23194e93d005f404e2183c0f92..efb072059b35fcb50060e3989ef221b2875dbbf4 100644 (file)
--- a/Source/WebCore/dom/XMLDocumentParser.cpp
+++ b/Source/WebCore/dom/XMLDocumentParser.cpp
@@ -287,7 +287,7 @@ void XMLDocumentParser::insertErrorMessageBlock()
     // Create elements for display
     ExceptionCode ec = 0;
     Document* document = this->document();
-    Element* documentElement = document->documentElement();
+    RefPtr<Element> documentElement = document->documentElement();
     if (!documentElement) {
         RefPtr<Element> rootElement = document->createElement(htmlTag, false);
         document->appendChild(rootElement, ec);