Make sure the rootNode of a LiveNodeListBase is always a ContainerNode

Source/core/dom/NodeRareData.h

 /*
  * Copyright (C) 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 David Smith <catfish.man@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 27 matching lines @@
 
 class LabelsNodeList;
 class RadioNodeList;
 class TreeScope;
 
 class NodeListsNodeData {
     WTF_MAKE_NONCOPYABLE(NodeListsNodeData); WTF_MAKE_FAST_ALLOCATED;
 public:
     void clearChildNodeListCache()
     {
-        if (m_childNodeList)
-            m_childNodeList->invalidateCache();
+        if (m_childNodeList && m_childNodeList->isLiveNodeList())
+            static_cast<LiveNodeList*>(m_childNodeList)->invalidateCache();
     }
 
-    PassRefPtr<ChildNodeList> ensureChildNodeList(Node* node)
+    PassRefPtr<ChildNodeList> ensureChildNodeList(ContainerNode* node)
     {
-        if (m_childNodeList)
-            return m_childNodeList;
+        if (m_childNodeList) {
+            ASSERT_WITH_SECURITY_IMPLICATION(!m_childNodeList->isEmptyNodeList());
+            return static_cast<ChildNodeList*>(m_childNodeList);
+        }
         RefPtr<ChildNodeList> list = ChildNodeList::create(node);
         m_childNodeList = list.get();
         return list.release();
     }
 
+    PassRefPtr<EmptyNodeList> ensureEmptyChildNodeList(Node* node)
+    {
+        if (m_childNodeList) {
+            ASSERT_WITH_SECURITY_IMPLICATION(m_childNodeList->isEmptyNodeList());
+            return static_cast<EmptyNodeList*>(m_childNodeList);

[esprehn, 2014/01/17 07:06:20]

Add a casting method, there's macros for that. toEmptyNodeList(...) that'll do
the ASSERT for you so you don't need it here.

[Inactive, 2014/01/17 15:00:48]

Done.

+        }
+        RefPtr<EmptyNodeList> list = EmptyNodeList::create(node);

[esprehn, 2014/01/17 07:06:20]

If you reverse the clauses you can make this function a lot shorter. You also
don't need the local.

if (!m_childNodeList)
  m_childNodeList = EmptyNodeList::create(node);
return toEmptyNodeList(m_childNodeList.get());

[Inactive, 2014/01/17 15:00:48]

The issue is that m_childNodeList is a raw pointer, not a RefPtr. We pass
ownership to the caller and merely keep a raw pointer to the list. This is why
we need a temporary RefPtr here. Let me know if there is still a simpler
pattern. At least, I could not come up with something better.

+        m_childNodeList = list.get();
+        return list.release();
+    }
+
     void removeChildNodeList(ChildNodeList* list)
     {
         ASSERT(m_childNodeList == list);
         if (deleteThisAndUpdateNodeRareDataIfAboutToRemoveLastList(list->ownerNode()))
             return;
         m_childNodeList = 0;
     }
 
+    void removeEmptyChildNodeList(EmptyNodeList* list)
+    {
+        ASSERT(m_childNodeList == list);
+        if (deleteThisAndUpdateNodeRareDataIfAboutToRemoveLastList(list->ownerNode()))
+            return;
+        m_childNodeList = 0;
+    }
+
     template <typename StringType>
     struct NodeListCacheMapEntryHash {
         static unsigned hash(const std::pair<unsigned char, StringType>& entry)
         {
             return DefaultHash<StringType>::Hash::hash(entry.second) + entry.first;
         }
         static bool equal(const std::pair<unsigned char, StringType>& a, const std::pair<unsigned char, StringType>& b) { return a == b; }
         static const bool safeToCompareToEmptyOrDeleted = DefaultHash<StringType>::Hash::safeToCompareToEmptyOrDeleted;
     };
 
     typedef HashMap<std::pair<unsigned char, AtomicString>, LiveNodeListBase*, NodeListCacheMapEntryHash<AtomicString> > NodeListAtomicNameCacheMap;
     typedef HashMap<std::pair<unsigned char, String>, LiveNodeListBase*, NodeListCacheMapEntryHash<String> > NodeListNameCacheMap;
     typedef HashMap<QualifiedName, TagNodeList*> TagNodeListCacheNS;
 
     template<typename T>
-    PassRefPtr<T> addCacheWithAtomicName(Node* node, CollectionType collectionType, const AtomicString& name)
+    PassRefPtr<T> addCacheWithAtomicName(ContainerNode* node, CollectionType collectionType, const AtomicString& name)
     {
         NodeListAtomicNameCacheMap::AddResult result = m_atomicNameCaches.add(namedNodeListKey(collectionType, name), 0);
         if (!result.isNewEntry)
             return static_cast<T*>(result.iterator->value);
 
         RefPtr<T> list = T::create(node, collectionType, name);
         result.iterator->value = list.get();
         return list.release();
     }
 
     // FIXME: This function should be renamed since it doesn't have an atomic name.
     template<typename T>
-    PassRefPtr<T> addCacheWithAtomicName(Node* node, CollectionType collectionType)
+    PassRefPtr<T> addCacheWithAtomicName(ContainerNode* node, CollectionType collectionType)
     {
         NodeListAtomicNameCacheMap::AddResult result = m_atomicNameCaches.add(namedNodeListKey(collectionType, starAtom), 0);
         if (!result.isNewEntry)
             return static_cast<T*>(result.iterator->value);
 
         RefPtr<T> list = T::create(node, collectionType);
         result.iterator->value = list.get();
         return list.release();
     }
 
     template<typename T>
     T* cacheWithAtomicName(CollectionType collectionType)
     {
         return static_cast<T*>(m_atomicNameCaches.get(namedNodeListKey(collectionType, starAtom)));
     }
 
     template<typename T>
     PassRefPtr<T> addCacheWithName(Node* node, CollectionType collectionType, const String& name)
     {
         NodeListNameCacheMap::AddResult result = m_nameCaches.add(namedNodeListKey(collectionType, name), 0);
         if (!result.isNewEntry)
             return static_cast<T*>(result.iterator->value);
 
         RefPtr<T> list = T::create(node, name);
         result.iterator->value = list.get();
         return list.release();
     }
 
-    PassRefPtr<TagNodeList> addCacheWithQualifiedName(Node* node, const AtomicString& namespaceURI, const AtomicString& localName)
+    PassRefPtr<TagNodeList> addCacheWithQualifiedName(ContainerNode* node, const AtomicString& namespaceURI, const AtomicString& localName)
     {
         QualifiedName name(nullAtom, localName, namespaceURI);
         TagNodeListCacheNS::AddResult result = m_tagNodeListCacheNS.add(name, 0);
         if (!result.isNewEntry)
             return result.iterator->value;
 
         RefPtr<TagNodeList> list = TagNodeList::create(node, namespaceURI, localName);
         result.iterator->value = list.get();
         return list.release();
     }
@@ skipping 78 matching lines @@
         return std::pair<unsigned char, AtomicString>(type, name);
     }
 
     std::pair<unsigned char, String> namedNodeListKey(CollectionType type, const String& name)
     {
         return std::pair<unsigned char, String>(type, name);
     }
 
     bool deleteThisAndUpdateNodeRareDataIfAboutToRemoveLastList(Node*);
 
-    // FIXME: m_childNodeList should be merged into m_atomicNameCaches or at least be shared with HTMLCollection returned by Element::children
-    // but it's tricky because invalidateCaches shouldn't invalidate this cache and adoptTreeScope shouldn't call registerNodeList or unregisterNodeList.
-    ChildNodeList* m_childNodeList;
+    // Can be a ChildNodeList or an EmptyNodeList.
+    NodeList* m_childNodeList;
     NodeListAtomicNameCacheMap m_atomicNameCaches;
     NodeListNameCacheMap m_nameCaches;
     TagNodeListCacheNS m_tagNodeListCacheNS;
 };
 
 class NodeMutationObserverData {
     WTF_MAKE_NONCOPYABLE(NodeMutationObserverData); WTF_MAKE_FAST_ALLOCATED;
 public:
     Vector<OwnPtr<MutationObserverRegistration> > registry;
     HashSet<MutationObserverRegistration*> transientRegistry;
@@ skipping 60 matching lines @@
     ownerNode->clearNodeLists();
     return true;
 }
 
 // Ensure the 10 bits reserved for the m_connectedFrameCount cannot overflow
 COMPILE_ASSERT(Page::maxNumberOfFrames < 1024, Frame_limit_should_fit_in_rare_data_count);
 
 } // namespace WebCore
 
 #endif // NodeRareData_h