Make sure the rootNode of a LiveNodeListBase is always a ContainerNode

Source/core/dom/LiveNodeList.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 30 matching lines @@
     NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr,
 };
 
 class LiveNodeListBase {
 public:
     enum ItemAfterOverrideType {
         OverridesItemAfter,
         DoesNotOverrideItemAfter,
     };
 
-    LiveNodeListBase(Node* ownerNode, NodeListRootType rootType, NodeListInvalidationType invalidationType,
+    LiveNodeListBase(ContainerNode* ownerNode, NodeListRootType rootType, NodeListInvalidationType invalidationType,
         bool shouldOnlyIncludeDirectChildren, CollectionType collectionType, ItemAfterOverrideType itemAfterOverrideType)
         : m_ownerNode(ownerNode)
         , m_cachedItem(0)
         , m_isLengthCacheValid(false)
         , m_isItemCacheValid(false)
         , m_rootType(rootType)
         , m_invalidationType(invalidationType)
         , m_shouldOnlyIncludeDirectChildren(shouldOnlyIncludeDirectChildren)
         , m_collectionType(collectionType)
         , m_overridesItemAfter(itemAfterOverrideType == OverridesItemAfter)
     {
+        ASSERT(m_ownerNode);
         ASSERT(m_rootType == static_cast<unsigned>(rootType));
         ASSERT(m_invalidationType == static_cast<unsigned>(invalidationType));
         ASSERT(m_collectionType == static_cast<unsigned>(collectionType));
         ASSERT(!m_overridesItemAfter || !isLiveNodeListType(collectionType));
 
         if (collectionType != ChildNodeListType)
             document().registerNodeList(this);
     }
 
     virtual ~LiveNodeListBase()
     {
         if (type() != ChildNodeListType)
             document().unregisterNodeList(this);
     }
 
     unsigned length() const;
     Node* item(unsigned offset) const;
 
     ALWAYS_INLINE bool hasIdNameCache() const { return !isLiveNodeListType(type()); }
     ALWAYS_INLINE bool isRootedAtDocument() const { return m_rootType == NodeListIsRootedAtDocument || m_rootType == NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr; }
     ALWAYS_INLINE NodeListInvalidationType invalidationType() const { return static_cast<NodeListInvalidationType>(m_invalidationType); }
     ALWAYS_INLINE CollectionType type() const { return static_cast<CollectionType>(m_collectionType); }
-    Node* ownerNode() const { return m_ownerNode.get(); }
+    ContainerNode* ownerNode() const { return m_ownerNode.get(); }
     ALWAYS_INLINE void invalidateCache(const QualifiedName* attrName) const
     {
         if (!attrName || shouldInvalidateTypeOnAttributeChange(invalidationType(), *attrName))
             invalidateCache();
         else if (hasIdNameCache() && (*attrName == HTMLNames::idAttr || *attrName == HTMLNames::nameAttr))
             invalidateIdNameCacheMaps();
     }
     virtual void invalidateCache() const;
 
     static bool shouldInvalidateTypeOnAttributeChange(NodeListInvalidationType, const QualifiedName&);
 
 protected:
     Document& document() const { return m_ownerNode->document(); }
-    Node& rootNode() const;
-    ContainerNode* rootContainerNode() const;
+    ContainerNode& rootNode() const;
     bool overridesItemAfter() const { return m_overridesItemAfter; }
 
     ALWAYS_INLINE bool isItemCacheValid() const { return m_isItemCacheValid; }
     ALWAYS_INLINE Node* cachedItem() const { return m_cachedItem; }
     ALWAYS_INLINE unsigned cachedItemOffset() const { return m_cachedItemOffset; }
 
     ALWAYS_INLINE bool isLengthCacheValid() const { return m_isLengthCacheValid; }
     ALWAYS_INLINE unsigned cachedLength() const { return m_cachedLength; }
     ALWAYS_INLINE void setLengthCache(unsigned length) const
     {
         m_cachedLength = length;
         m_isLengthCacheValid = true;
     }
     ALWAYS_INLINE void setItemCache(Node* item, unsigned offset) const
     {
         ASSERT(item);
         m_cachedItem = item;
         m_cachedItemOffset = offset;
         m_isItemCacheValid = true;
     }
 
     ALWAYS_INLINE NodeListRootType rootType() const { return static_cast<NodeListRootType>(m_rootType); }
     bool shouldOnlyIncludeDirectChildren() const { return m_shouldOnlyIncludeDirectChildren; }
 
 private:
-    Node* itemBeforeOrAfterCachedItem(unsigned offset, ContainerNode* root) const;
+    Node* itemBeforeOrAfterCachedItem(unsigned offset, ContainerNode& root) const;
     bool isLastItemCloserThanLastOrCachedItem(unsigned offset) const;
     bool isFirstItemCloserThanCachedItem(unsigned offset) const;
     Node* iterateForPreviousNode(Node* current) const;
     Node* itemBefore(Node* previousItem) const;
     void invalidateIdNameCacheMaps() const;
 
-    RefPtr<Node> m_ownerNode;
+    RefPtr<ContainerNode> m_ownerNode; // Cannot be null.
     mutable Node* m_cachedItem;
     mutable unsigned m_cachedLength;
     mutable unsigned m_cachedItemOffset;
     mutable unsigned m_isLengthCacheValid : 1;
     mutable unsigned m_isItemCacheValid : 1;
     const unsigned m_rootType : 2;
     const unsigned m_invalidationType : 4;
     const unsigned m_shouldOnlyIncludeDirectChildren : 1;
     const unsigned m_collectionType : 5;
 
@@ skipping 21 matching lines @@
     case DoNotInvalidateOnAttributeChanges:
         return false;
     case InvalidateOnAnyAttrChange:
         return true;
     }
     return false;
 }
 
 class LiveNodeList : public NodeList, public LiveNodeListBase {
 public:
-    LiveNodeList(PassRefPtr<Node> ownerNode, CollectionType collectionType, NodeListInvalidationType invalidationType, NodeListRootType rootType = NodeListIsRootedAtNode)
+    LiveNodeList(PassRefPtr<ContainerNode> ownerNode, CollectionType collectionType, NodeListInvalidationType invalidationType, NodeListRootType rootType = NodeListIsRootedAtNode)
         : LiveNodeListBase(ownerNode.get(), rootType, invalidationType, collectionType == ChildNodeListType,
         collectionType, DoesNotOverrideItemAfter)
     { }
 
     virtual unsigned length() const OVERRIDE FINAL { return LiveNodeListBase::length(); }
     virtual Node* item(unsigned offset) const OVERRIDE FINAL { return LiveNodeListBase::item(offset); }
     virtual Node* namedItem(const AtomicString&) const OVERRIDE FINAL;
     virtual bool nodeMatches(Element*) const = 0;
     // Avoid ambiguity since both NodeList and LiveNodeListBase have an ownerNode() method.
     using LiveNodeListBase::ownerNode;
 
     Node* traverseToFirstElement(ContainerNode& root) const;
-    Node* traverseForwardToOffset(unsigned offset, Node& currentNode, unsigned& currentOffset, ContainerNode* root) const;
+    Node* traverseForwardToOffset(unsigned offset, Node& currentNode, unsigned& currentOffset, ContainerNode& root) const;
 
 private:
     virtual bool isLiveNodeList() const OVERRIDE FINAL { return true; }
 };
 
 } // namespace WebCore
 
 #endif // LiveNodeList_h