Make sure the rootNode of a LiveNodeListBase is always a ContainerNode

Source/core/dom/NodeRareData.h

Index: Source/core/dom/NodeRareData.h
diff --git a/Source/core/dom/NodeRareData.h b/Source/core/dom/NodeRareData.h
index e2e2879f0dcfc1e7560fbdc0e46ac2783b403851..0564d6f856e0130252eae610ef4421a1869c7e42 100644
--- a/Source/core/dom/NodeRareData.h
+++ b/Source/core/dom/NodeRareData.h
@@ -45,19 +45,32 @@ class NodeListsNodeData {
 public:
     void clearChildNodeListCache()
     {
-        if (m_childNodeList)
-            m_childNodeList->invalidateCache();
+        if (m_childNodeList && m_childNodeList->isLiveNodeList())
+            static_cast<LiveNodeList*>(m_childNodeList)->invalidateCache();
     }
 
-    PassRefPtr<ChildNodeList> ensureChildNodeList(Node* node)
+    PassRefPtr<ChildNodeList> ensureChildNodeList(ContainerNode* node)
     {
-        if (m_childNodeList)
-            return m_childNodeList;
+        if (m_childNodeList) {
+            ASSERT_WITH_SECURITY_IMPLICATION(!m_childNodeList->isEmptyNodeList());
+            return static_cast<ChildNodeList*>(m_childNodeList);
+        }
         RefPtr<ChildNodeList> list = ChildNodeList::create(node);
         m_childNodeList = list.get();
         return list.release();
     }
 
+    PassRefPtr<EmptyNodeList> ensureEmptyChildNodeList(Node* node)
+    {
+        if (m_childNodeList) {
+            ASSERT_WITH_SECURITY_IMPLICATION(m_childNodeList->isEmptyNodeList());
+            return static_cast<EmptyNodeList*>(m_childNodeList);

[esprehn, 2014/01/17 07:06:20]

Add a casting method, there's macros for that. toEmptyNodeList(...) that'll do
the ASSERT for you so you don't need it here.

[Inactive, 2014/01/17 15:00:48]

Done.

+        }
+        RefPtr<EmptyNodeList> list = EmptyNodeList::create(node);

[esprehn, 2014/01/17 07:06:20]

If you reverse the clauses you can make this function a lot shorter. You also
don't need the local.

if (!m_childNodeList)
  m_childNodeList = EmptyNodeList::create(node);
return toEmptyNodeList(m_childNodeList.get());

[Inactive, 2014/01/17 15:00:48]

The issue is that m_childNodeList is a raw pointer, not a RefPtr. We pass
ownership to the caller and merely keep a raw pointer to the list. This is why
we need a temporary RefPtr here. Let me know if there is still a simpler
pattern. At least, I could not come up with something better.

+        m_childNodeList = list.get();
+        return list.release();
+    }
+
     void removeChildNodeList(ChildNodeList* list)
     {
         ASSERT(m_childNodeList == list);
@@ -66,6 +79,14 @@ public:
         m_childNodeList = 0;
     }
 
+    void removeEmptyChildNodeList(EmptyNodeList* list)
+    {
+        ASSERT(m_childNodeList == list);
+        if (deleteThisAndUpdateNodeRareDataIfAboutToRemoveLastList(list->ownerNode()))
+            return;
+        m_childNodeList = 0;
+    }
+
     template <typename StringType>
     struct NodeListCacheMapEntryHash {
         static unsigned hash(const std::pair<unsigned char, StringType>& entry)
@@ -81,7 +102,7 @@ public:
     typedef HashMap<QualifiedName, TagNodeList*> TagNodeListCacheNS;
 
     template<typename T>
-    PassRefPtr<T> addCacheWithAtomicName(Node* node, CollectionType collectionType, const AtomicString& name)
+    PassRefPtr<T> addCacheWithAtomicName(ContainerNode* node, CollectionType collectionType, const AtomicString& name)
     {
         NodeListAtomicNameCacheMap::AddResult result = m_atomicNameCaches.add(namedNodeListKey(collectionType, name), 0);
         if (!result.isNewEntry)
@@ -94,7 +115,7 @@ public:
 
     // FIXME: This function should be renamed since it doesn't have an atomic name.
     template<typename T>
-    PassRefPtr<T> addCacheWithAtomicName(Node* node, CollectionType collectionType)
+    PassRefPtr<T> addCacheWithAtomicName(ContainerNode* node, CollectionType collectionType)
     {
         NodeListAtomicNameCacheMap::AddResult result = m_atomicNameCaches.add(namedNodeListKey(collectionType, starAtom), 0);
         if (!result.isNewEntry)
@@ -123,7 +144,7 @@ public:
         return list.release();
     }
 
-    PassRefPtr<TagNodeList> addCacheWithQualifiedName(Node* node, const AtomicString& namespaceURI, const AtomicString& localName)
+    PassRefPtr<TagNodeList> addCacheWithQualifiedName(ContainerNode* node, const AtomicString& namespaceURI, const AtomicString& localName)
     {
         QualifiedName name(nullAtom, localName, namespaceURI);
         TagNodeListCacheNS::AddResult result = m_tagNodeListCacheNS.add(name, 0);
@@ -222,9 +243,8 @@ private:
 
     bool deleteThisAndUpdateNodeRareDataIfAboutToRemoveLastList(Node*);
 
-    // FIXME: m_childNodeList should be merged into m_atomicNameCaches or at least be shared with HTMLCollection returned by Element::children
-    // but it's tricky because invalidateCaches shouldn't invalidate this cache and adoptTreeScope shouldn't call registerNodeList or unregisterNodeList.
-    ChildNodeList* m_childNodeList;
+    // Can be a ChildNodeList or an EmptyNodeList.
+    NodeList* m_childNodeList;
     NodeListAtomicNameCacheMap m_atomicNameCaches;
     NodeListNameCacheMap m_nameCaches;
     TagNodeListCacheNS m_tagNodeListCacheNS;