/[blink]
Chromium logo

Revision 160037


Jump to revision: Previous Next
Author: yosin@chromium.org
Date: Mon Oct 21 01:33:56 2013 UTC (9 years, 7 months ago)
Changed paths: 7
Log Message:
Merge 159007 "Notify nodes removal to Range/Selection after disp..."

> Notify nodes removal to Range/Selection after dispatching blur and mutation event
> 
> This patch changes notifying nodes removal to Range/Selection after dispatching blur and mutation event. In willRemoveChildren(), like willRemoveChild(); r115686 did same change, although it didn't change willRemoveChildren().
> 
> The issue 295010, use-after-free, is caused by setting removed node to Selection in mutation event handler.
> 
> BUG=295010
> TEST=LayoutTests/fast/dom/Range/range-created-during-remove-children.html, LayoutTests/editing/selection/selection-change-in-mutation-event-by-remove-children.html, LayoutTests/editing/selection/selection-change-in-blur-event-by-remove-children.html
> R=tkent@chromium.org
> 
> Review URL: https://codereview.chromium.org/25389004

TBR=yosin@chromium.org

Review URL: https://codereview.chromium.org/30663003

Changed paths

Path Details
Directorybranches/chromium/1650/LayoutTests/editing/selection/selection-change-in-blur-event-by-remove-children-expected.txt
(Copied from trunk/LayoutTests/editing/selection/selection-change-in-blur-event-by-remove-children-expected.txt, r159007)
added
Directorybranches/chromium/1650/LayoutTests/editing/selection/selection-change-in-blur-event-by-remove-children.html
(Copied from trunk/LayoutTests/editing/selection/selection-change-in-blur-event-by-remove-children.html, r159007)
added
Directorybranches/chromium/1650/LayoutTests/editing/selection/selection-change-in-mutation-event-by-remove-children-expected.txt
(Copied from trunk/LayoutTests/editing/selection/selection-change-in-mutation-event-by-remove-children-expected.txt, r159007)
added
Directorybranches/chromium/1650/LayoutTests/editing/selection/selection-change-in-mutation-event-by-remove-children.html
(Copied from trunk/LayoutTests/editing/selection/selection-change-in-mutation-event-by-remove-children.html, r159007)
added
Directorybranches/chromium/1650/LayoutTests/fast/dom/Range/range-created-during-remove-children-expected.txt
(Copied from trunk/LayoutTests/fast/dom/Range/range-created-during-remove-children-expected.txt, r159007)
added
Directorybranches/chromium/1650/LayoutTests/fast/dom/Range/range-created-during-remove-children.html
(Copied from trunk/LayoutTests/fast/dom/Range/range-created-during-remove-children.html, r159007)
added
Directorybranches/chromium/1650/Source/core/dom/ContainerNode.cpp modified , text changed

Powered by ViewVC 1.1.26 ViewVC Help