Source/WebCore: Inconsistent state of TreeScope reference.
authorMORITA Hajime <morrita@google.com>
Thu, 28 Jul 2011 03:44:57 +0000 (03:44 +0000)
committerAdemar de Souza Reis Jr <ademar.reis@openbossa.org>
Fri, 29 Jul 2011 14:52:19 +0000 (11:52 -0300)
commiteb83f1fc36d6c59b13b2b6f077d6eb7027d35fc6
treef551b3471ed85480bec1d1a23f2be011bf6e0e34
parent6e2b7712d2ba7077eb03a21d9cd06577514cee12
Source/WebCore: Inconsistent state of TreeScope reference.
https://bugs.webkit.org/show_bug.cgi?id=65235

The tree scope pointers on shadow tree nodes didn't cleared.
even when the tree scope (shadow root) is destroyed.
This change clear these poitners before detaching the shadow root.

Reviewed by Dimitri Glazkov.

Test: fast/dom/shadow/tree-scope-crash.html

* dom/Element.cpp:
(WebCore::Element::removeShadowRoot):

LayoutTests: Inconsistent state of TreeScope reference.
https://bugs.webkit.org/show_bug.cgi?id=65235

Reviewed by Dimitri Glazkov.

* fast/dom/shadow/tree-scope-crash-expected.txt: Added.
* fast/dom/shadow/tree-scope-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91895 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/dom/shadow/tree-scope-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/shadow/tree-scope-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/dom/Element.cpp