From: inferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Tue, 31 May 2011 16:51:09 +0000 (+0000)
Subject: 2011-05-31  Abhishek Arya  <inferno@chromium.org>
X-Git-Url: https://git.webkit.org/?p=WebKit-https.git;a=commitdiff_plain;h=e6b40a2702de88ce8a8da73b78fe5d8e29ab7a28

2011-05-31  Abhishek Arya  <inferno@chromium.org>

        Reviewed by Dimitri Glazkov.

        Convert raw ptr to RefPtr for documentElement.
        https://bugs.webkit.org/show_bug.cgi?id=61688

        Test: fast/dom/xml-parser-error-message-crash.svg

        * dom/XMLDocumentParser.cpp:
        (WebCore::XMLDocumentParser::insertErrorMessageBlock):
2011-05-31  Abhishek Arya  <inferno@chromium.org>

        Reviewed by Dimitri Glazkov.

        Test that we do not crash when a DOMNodeInsertedIntoDocument event
        is fired while generating a error message block in xml parsing.
        https://bugs.webkit.org/show_bug.cgi?id=61688

        * fast/dom/xml-parser-error-message-crash-expected.txt: Added.
        * fast/dom/xml-parser-error-message-crash.svg: Added.


git-svn-id: https://svn.webkit.org/repository/webkit/trunk@87737 268f45cc-cd09-0410-ab3c-d52691b4dbfc
---

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index dee2b2f59807..e09adeae6378 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2011-05-31  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Test that we do not crash when a DOMNodeInsertedIntoDocument event
+        is fired while generating a error message block in xml parsing.
+        https://bugs.webkit.org/show_bug.cgi?id=61688
+
+        * fast/dom/xml-parser-error-message-crash-expected.txt: Added.
+        * fast/dom/xml-parser-error-message-crash.svg: Added.
+
 2011-05-31  Andreas Kling  <kling@webkit.org>
 
         Reviewed by Antti Koivisto.
diff --git a/LayoutTests/fast/dom/xml-parser-error-message-crash-expected.txt b/LayoutTests/fast/dom/xml-parser-error-message-crash-expected.txt
new file mode 100644
index 000000000000..7ef22e9a431a
--- /dev/null
+++ b/LayoutTests/fast/dom/xml-parser-error-message-crash-expected.txt
@@ -0,0 +1 @@
+PASS
diff --git a/LayoutTests/fast/dom/xml-parser-error-message-crash.svg b/LayoutTests/fast/dom/xml-parser-error-message-crash.svg
new file mode 100644
index 000000000000..467710e87434
--- /dev/null
+++ b/LayoutTests/fast/dom/xml-parser-error-message-crash.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function runTest()
+{
+    document.firstChild.innerHTML = "PASS";
+}
+
+document.addEventListener("DOMNodeInsertedIntoDocument", runTest, true);
+</script>
+
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index ca66596f8922..3069b9f0ffc9 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2011-05-31  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Convert raw ptr to RefPtr for documentElement.
+        https://bugs.webkit.org/show_bug.cgi?id=61688
+
+        Test: fast/dom/xml-parser-error-message-crash.svg
+
+        * dom/XMLDocumentParser.cpp:
+        (WebCore::XMLDocumentParser::insertErrorMessageBlock):
+
 2011-05-31  Andreas Kling  <kling@webkit.org>
 
         Reviewed by Antti Koivisto.
diff --git a/Source/WebCore/dom/XMLDocumentParser.cpp b/Source/WebCore/dom/XMLDocumentParser.cpp
index 6d8094fe0c65..efb072059b35 100644
--- a/Source/WebCore/dom/XMLDocumentParser.cpp
+++ b/Source/WebCore/dom/XMLDocumentParser.cpp
@@ -287,7 +287,7 @@ void XMLDocumentParser::insertErrorMessageBlock()
     // Create elements for display
     ExceptionCode ec = 0;
     Document* document = this->document();
-    Element* documentElement = document->documentElement();
+    RefPtr<Element> documentElement = document->documentElement();
     if (!documentElement) {
         RefPtr<Element> rootElement = document->createElement(htmlTag, false);
         document->appendChild(rootElement, ec);