Title: [143118] trunk/Source/WebCore
- Revision
- 143118
- Author
- akl...@apple.com
- Date
- 2013-02-16 17:02:08 -0800 (Sat, 16 Feb 2013)
Log Message
[JSC] Remove custom mark function for NamedNodeMap.
<http://webkit.org/b/110029>
Reviewed by Darin Adler.
NamedNodeMap refs and unrefs its Element owner, so there's no need for the wrapper to keep the Element alive.
Covered by fast/dom/Attr/access-after-element-destruction.html
* bindings/js/JSNamedNodeMapCustom.cpp:
* dom/NamedNodeMap.idl:
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (143117 => 143118)
--- trunk/Source/WebCore/ChangeLog 2013-02-17 00:11:56 UTC (rev 143117)
+++ trunk/Source/WebCore/ChangeLog 2013-02-17 01:02:08 UTC (rev 143118)
@@ -1,3 +1,17 @@
+2013-02-16 Andreas Kling <akl...@apple.com>
+
+ [JSC] Remove custom mark function for NamedNodeMap.
+ <http://webkit.org/b/110029>
+
+ Reviewed by Darin Adler.
+
+ NamedNodeMap refs and unrefs its Element owner, so there's no need for the wrapper to keep the Element alive.
+
+ Covered by fast/dom/Attr/access-after-element-destruction.html
+
+ * bindings/js/JSNamedNodeMapCustom.cpp:
+ * dom/NamedNodeMap.idl:
+
2013-02-16 Peter Nelson <pe...@peterdn.com>
REGRESSION(r143076): Crash when calling removeNamedItem or removeNamedItemNS with a non-existent attribute of newly created element.
Modified: trunk/Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp (143117 => 143118)
--- trunk/Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp 2013-02-17 00:11:56 UTC (rev 143117)
+++ trunk/Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp 2013-02-17 01:02:08 UTC (rev 143118)
@@ -46,22 +46,4 @@
return toJS(exec, thisObj->globalObject(), thisObj->impl()->getNamedItem(propertyNameToAtomicString(propertyName)));
}
-void JSNamedNodeMap::visitChildren(JSCell* cell, SlotVisitor& visitor)
-{
- JSNamedNodeMap* thisObject = jsCast<JSNamedNodeMap*>(cell);
- ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
- COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
- ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
- Base::visitChildren(thisObject, visitor);
-
- // We need to keep the wrapper for our underlying NamedNodeMap's element
- // alive because NamedNodeMap and Attr rely on the element for data, and
- // don't know how to keep it alive correctly.
- // FIXME: Fix this lifetime issue in the DOM, and remove this.
- Element* element = thisObject->impl()->element();
- if (!element)
- return;
- visitor.addOpaqueRoot(root(element));
-}
-
} // namespace WebCore
Modified: trunk/Source/WebCore/dom/NamedNodeMap.idl (143117 => 143118)
--- trunk/Source/WebCore/dom/NamedNodeMap.idl 2013-02-17 00:11:56 UTC (rev 143117)
+++ trunk/Source/WebCore/dom/NamedNodeMap.idl 2013-02-17 01:02:08 UTC (rev 143118)
@@ -21,7 +21,6 @@
[
GenerateIsReachable=ImplElementRoot,
IndexedGetter,
- JSCustomMarkFunction,
NamedGetter,
ImplementationLacksVTable
] interface NamedNodeMap {
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
