/[blink]
Chromium logo

Revision 200690


Jump to revision: Previous Next
Author: marius.mlynski@gmail.com
Date: Tue Aug 18 04:30:56 2015 UTC (7 years, 9 months ago)
Changed paths: 3
Log Message:
parserInsertBefore: Bail out if the parent no longer contains the child.

nextChild may be removed from the DOM tree during the
|parserRemoveChild(*newChild)| call which triggers unload events of newChild's 
descendant iframes. In order to maintain the integrity of the DOM tree, the
insertion of newChild must be aborted in this case.

This patch adds a return statement that rectifies the behavior in this
edge case.

BUG=519558

Review URL: https://codereview.chromium.org/1283263002

Changed paths

Path Details
Directorytrunk/LayoutTests/fast/parser/scriptexec-during-parserInsertBefore-expected.txt added
Directorytrunk/LayoutTests/fast/parser/scriptexec-during-parserInsertBefore.html added
Directorytrunk/Source/core/dom/ContainerNode.cpp modified , text changed

Properties

Name Value
commit-bot commit-bot@chromium.org

Powered by ViewVC 1.1.26 ViewVC Help