Skip to content
Permalink
Browse files
Fix Bug 17876: REGRESSION (r31060): Attempting to visit Ofcom page ca…
…uses crash

WebCore:

        Fix Bug 17876: REGRESSION (r31060): Attempting to visit Ofcom page causes crash

        <http://bugs.webkit.org/show_bug.cgi?id=17876>

        Reviewed by John.

        Test: fast/dom/remove-named-attribute-crash.html

        * dom/NamedAttrMap.cpp:
        (WebCore::NamedAttrMap::removeAttribute): Store the Attribute we're
        going to remove from the m_attributes Vector in a RefPtr so it doesn't
        get deleted when it is removed from the Vector.

LayoutTests:

        Test for Bug 17876: REGRESSION (r31060): Attempting to visit Ofcom page causes crash

        <http://bugs.webkit.org/show_bug.cgi?id=17876>

        Reviewed by John.

        * fast/dom/remove-named-attribute-crash-expected.txt: Added.
        * fast/dom/remove-named-attribute-crash.html: Added.


Canonical link: https://commits.webkit.org/24778@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@31095 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
aroben committed Mar 17, 2008
1 parent 7ca41f5 commit c3af7500aecd586f5011a90eeed77cd9f879dfec
@@ -1,3 +1,14 @@
2008-03-17 Adam Roben <aroben@apple.com>

Test for Bug 17876: REGRESSION (r31060): Attempting to visit Ofcom page causes crash

<http://bugs.webkit.org/show_bug.cgi?id=17876>

Reviewed by John.

* fast/dom/remove-named-attribute-crash-expected.txt: Added.
* fast/dom/remove-named-attribute-crash.html: Added.

2008-03-16 Maciej Stachowiak <mjs@apple.com>

Reviewed by Darin.
@@ -0,0 +1,5 @@
Test for Bug 17876: REGRESSION (r31060): Attempting to visit Ofcom page causes crash.

Loading this page should not cause a crash.

PASS
@@ -0,0 +1,10 @@
<p>Test for <a href="http://bugs.webkit.org/show_bug.cgi?id=17876">Bug 17876: REGRESSION (r31060): Attempting to visit Ofcom page causes crash</a>.</p>
<p>Loading this page should not cause a crash.</p>

<button disabled>PASS</button>
<script>
document.getElementsByTagName('button')[0].disabled = false;

if (window.layoutTestController)
layoutTestController.dumpAsText();
</script>
@@ -1,3 +1,18 @@
2008-03-17 Adam Roben <aroben@apple.com>

Fix Bug 17876: REGRESSION (r31060): Attempting to visit Ofcom page causes crash

<http://bugs.webkit.org/show_bug.cgi?id=17876>

Reviewed by John.

Test: fast/dom/remove-named-attribute-crash.html

* dom/NamedAttrMap.cpp:
(WebCore::NamedAttrMap::removeAttribute): Store the Attribute we're
going to remove from the m_attributes Vector in a RefPtr so it doesn't
get deleted when it is removed from the Vector.

2008-03-17 Rodney Dawes <dobey@wayofthemonkey.com>

Reviewed by Adam Roben.
@@ -290,7 +290,7 @@ void NamedAttrMap::removeAttribute(const QualifiedName& name)
return;

// Remove the attribute from the list
Attribute* attr = m_attributes[index].get();
RefPtr<Attribute> attr = m_attributes[index].get();
if (Attr* a = m_attributes[index]->attr())
a->m_element = 0;

@@ -301,11 +301,11 @@ void NamedAttrMap::removeAttribute(const QualifiedName& name)
if (element && !attr->m_value.isNull()) {
AtomicString value = attr->m_value;
attr->m_value = nullAtom;
element->attributeChanged(attr);
element->attributeChanged(attr.get());
attr->m_value = value;
}
if (element) {
element->dispatchAttrRemovalEvent(attr);
element->dispatchAttrRemovalEvent(attr.get());
element->dispatchSubtreeModifiedEvent();
}
}

0 comments on commit c3af750

Please sign in to comment.