DescriptionparserInsertBefore: Bail out if the parent no longer contains the child.
nextChild may be removed from the DOM tree during the
|parserRemoveChild(*newChild)| call which triggers unload events of newChild's
descendant iframes. In order to maintain the integrity of the DOM tree, the
insertion of newChild must be aborted in this case.
This patch adds a return statement that rectifies the behavior in this
edge case.
BUG=519558
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=200690
Patch Set 1 #
Total comments: 4
Patch Set 2 : nit corrections #Patch Set 3 : fixed the failing test #
Messages
Total messages: 17 (4 generated)
|