-
morrita@google.com authored
https://bugs.webkit.org/show_bug.cgi?id=113035 Reviewed by Kentaro Hara. Source/WebCore: TreeScope destructor clears a document reference on ShadowRoot but destructors of ContainerNode and Node assumed it being available and tried to access it for some cleanup purposes. This change extracts such cleanup to Node::willBeDeletedFrom() and calls it from ShadowRoot dtor before the document reference gets cleared. Test: fast/dom/shadow/shadow-root-touch-listener-crash.html * dom/ContainerNode.cpp: (WebCore::ContainerNode::~ContainerNode): Adopted willBeDeletedFrom() * dom/Node.cpp: (WebCore::Node::~Node): Adopted willBeDeletedFrom() (WebCore::Node::willBeDeletedFrom): Extracted from Node and ContainerNode (WebCore): * dom/Node.h: * dom/ShadowRoot.cpp: (WebCore::ShadowRoot::~ShadowRoot): Adopted willBeDeletedFrom() LayoutTests: * fast/dom/shadow/shadow-root-touch-listener-crash-expected.txt: Added. * fast/dom/shadow/shadow-root-touch-listener-crash.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146853 268f45cc-cd09-0410-ab3c-d52691b4dbfc
71a8397c