2011-06-09 Adam Barth <abarth@webkit.org>
authorAdam Barth <abarth@webkit.org>
Thu, 9 Jun 2011 08:41:56 +0000 (08:41 +0000)
committerAdemar de Souza Reis Jr <ademar.reis@openbossa.org>
Mon, 27 Jun 2011 14:09:39 +0000 (11:09 -0300)
commit090e7650eb34eca3d02b07f2b49c433f9e1c63c1
tree707747b9bd8007751532a83d6e9ef1e33063c0d4
parentdff1fde839db3f36d4f9aea65fe3330bea307a35
2011-06-09  Adam Barth  <abarth@webkit.org>

        Reviewed by Eric Seidel.

        Running script from attach can remove elements from the stack of open elements
        https://bugs.webkit.org/show_bug.cgi?id=62160

        * fast/parser/document-write-onload-clear-expected.txt: Added.
        * fast/parser/document-write-onload-clear.html: Added.
2011-06-09  Adam Barth  <abarth@webkit.org>

        Reviewed by Eric Seidel.

        Running script from attach can remove elements from the stack of open elements
        https://bugs.webkit.org/show_bug.cgi?id=62160

        When the tree build runs script synchronously, that script can remove
        arbitrary elements from the stack of open elements.  We need to hold a
        reference to |parent| in attach instead of rely upon the reference in
        the stack of open elements.

        Test: fast/parser/document-write-onload-clear.html

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::attach):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88434 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/parser/document-write-onload-clear-expected.txt [new file with mode: 0644]
LayoutTests/fast/parser/document-write-onload-clear.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/html/parser/HTMLConstructionSite.cpp