-
commit-queue@webkit.org authored
https://bugs.webkit.org/show_bug.cgi?id=121694 Patch by László Langó <llango.u-szeged@partner.samsung.com> on 2014-01-21 Reviewed by Ryosuke Niwa. Source/WebCore: Based on Blink a change: https://chromium.googlesource.com/chromium/blink/+/407c1d7b2c45974aa614b3f847ffe9e8fce205fa This patch fix an assertion failure. Range::nodeWillBeRemoved() might be called with removed node in ContainerNode, when DOMNodeRemovedFromDocument event handler calls removeChild(), for node being removed. Test: fast/dom/Range/remove-twice-crash.html * dom/ContainerNode.cpp: (WebCore::ContainerNode::willRemoveChild): * dom/ContainerNode.h: LayoutTests: * fast/dom/Range/remove-twice-crash-expected.txt: Added. * fast/dom/Range/remove-twice-crash.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@162492 268f45cc-cd09-0410-ab3c-d52691b4dbfc
31ea78fd