Node::lazyAttach shouldn't lie about being attached

Source/core/dom/Node.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 847 matching lines @@
         return;
 
     StyleChangeType existingChangeType = styleChangeType();
     if (changeType > existingChangeType)
         setStyleChange(changeType);
 
     if (existingChangeType == NoStyleChange)
         markAncestorsWithChildNeedsStyleRecalc();
 }
 
-void Node::lazyAttach(ShouldSetAttached shouldSetAttached)
+void Node::lazyAttach()
 {
-    for (Node* n = this; n; n = NodeTraversal::next(n, this)) {
-        if (n->hasChildNodes())
-            n->setChildNeedsStyleRecalc();
-        n->setStyleChange(FullStyleChange);
-        if (shouldSetAttached == SetAttached)
-            n->setAttached();
+    // It's safe to synchronously attach here because we're in the middle of style recalc
+    // while it's not safe to mark nodes as needing style recalc except in the loop in
+    // Element::recalcStyle because we may mark an ancestor as not needing recalc and
+    // then the node would never get updated. One place this currently happens is
+    // HTMLObjectElement::renderFallbackContent which may call lazyAttach from inside
+    // attach which was triggered by a recalcStyle.
+    if (document()->inStyleRecalc()) {
+        attach();
+        return;
     }
+    setStyleChange(FullStyleChange);
     markAncestorsWithChildNeedsStyleRecalc();
 }
 
 bool Node::supportsFocus() const
 {
     return false;
 }
     
 bool Node::isFocusable() const
 {
@@ skipping 1884 matching lines @@
         node->showTreeForThis();
 }
 
 void showNodePath(const WebCore::Node* node)
 {
     if (node)
         node->showNodePathForThis();
 }
 
 #endif