Chromium Code Reviews| Index: Source/core/dom/ContainerNode.cpp |
| diff --git a/Source/core/dom/ContainerNode.cpp b/Source/core/dom/ContainerNode.cpp |
| index 651b192dee63a5331d2ac5c1009a1dffc378d8ca..b98275fbb2fc872646d2a7842f88dfe924795c21 100644 |
| --- a/Source/core/dom/ContainerNode.cpp |
| +++ b/Source/core/dom/ContainerNode.cpp |
| @@ -85,11 +85,8 @@ void ContainerNode::removeDetachedChildren() |
| void ContainerNode::parserTakeAllChildrenFrom(ContainerNode& oldParent) |
| { |
| - while (RefPtrWillBeRawPtr<Node> child = oldParent.firstChild()) { |
| - oldParent.parserRemoveChild(*child); |
| - treeScope().adoptIfNeeded(*child); |
| + while (RefPtrWillBeRawPtr<Node> child = oldParent.firstChild()) |
| parserAppendChild(child.get()); |
| - } |
| } |
| ContainerNode::~ContainerNode() |
| @@ -304,6 +301,12 @@ void ContainerNode::parserInsertBefore(PassRefPtrWillBeRawPtr<Node> newChild, No |
| RefPtrWillBeRawPtr<Node> protect(this); |
| + // FIXME: parserRemoveChild can run script which could then insert the |
| + // newChild back into the page. Loop until the child is actually removed. |
| + // See: fast/parser/execute-script-during-adoption-agency-removal.html |
| + while (RefPtrWillBeRawPtr<ContainerNode> parent = newChild->parentNode()) |
| + parent->parserRemoveChild(*newChild); |
| + |
| if (document() != newChild->document()) |
| document().adoptNode(newChild.get(), ASSERT_NO_EXCEPTION); |
| @@ -752,12 +755,17 @@ PassRefPtrWillBeRawPtr<Node> ContainerNode::appendChild(PassRefPtrWillBeRawPtr<N |
| void ContainerNode::parserAppendChild(PassRefPtrWillBeRawPtr<Node> newChild) |
| { |
| ASSERT(newChild); |
| - ASSERT(!newChild->parentNode()); // Use appendChild if you need to handle reparenting (and want DOM mutation events). |
|
esprehn
2015/05/01 05:36:58
Funny enough this ASSERT wasn't in parserInsertBef
adamk
2015/05/01 16:46:54
It's in insertBeforeCommon.
|
| ASSERT(!newChild->isDocumentFragment()); |
| ASSERT(!isHTMLTemplateElement(this)); |
| RefPtrWillBeRawPtr<Node> protect(this); |
| + // FIXME: parserRemoveChild can run script which could then insert the |
| + // newChild back into the page. Loop until the child is actually removed. |
| + // See: fast/parser/execute-script-during-adoption-agency-removal.html |
| + while (RefPtrWillBeRawPtr<ContainerNode> parent = newChild->parentNode()) |
| + parent->parserRemoveChild(*newChild); |
| + |
| if (document() != newChild->document()) |
| document().adoptNode(newChild.get(), ASSERT_NO_EXCEPTION); |