Make sure named item cache is always valid HTMLCollection::updateIdNameCache()

Source/core/html/HTMLCollection.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2014 Samsung Electronics. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 424 matching lines @@
 void HTMLCollection::namedPropertyEnumerator(Vector<String>& names, ExceptionState&)
 {
     supportedPropertyNames(names);
 }
 
 void HTMLCollection::updateIdNameCache() const
 {
     if (hasValidIdNameCache())
         return;
 
-    NamedItemCache& cache = createNamedItemCache();
+    OwnPtr<NamedItemCache> cache = NamedItemCache::create();
     for (Element* element = traverseToFirstElement(); element; element = traverseNextElement(*element)) {
         const AtomicString& idAttrVal = element->getIdAttribute();
         if (!idAttrVal.isEmpty())
-            cache.addElementWithId(idAttrVal, element);
+            cache->addElementWithId(idAttrVal, element);
         if (!element->isHTMLElement())
             continue;
         const AtomicString& nameAttrVal = element->getNameAttribute();
         if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal && (type() != DocAll || nameShouldBeVisibleInDocumentAll(toHTMLElement(*element))))
-            cache.addElementWithName(nameAttrVal, element);
+            cache->addElementWithName(nameAttrVal, element);
     }
+    // Set the named item cache last as traversing the tree may cause cache invalidation.
+    setNamedItemCache(cache.release());
 }
 
 void HTMLCollection::namedItems(const AtomicString& name, Vector<RefPtr<Element> >& result) const
 {
     ASSERT(result.isEmpty());
     if (name.isEmpty())
         return;
 
     updateIdNameCache();
 
     const NamedItemCache& cache = namedItemCache();
     Vector<Element*>* idResults = cache.getElementsById(name);
     Vector<Element*>* nameResults = cache.getElementsByName(name);
 
     for (unsigned i = 0; idResults && i < idResults->size(); ++i)
         result.append(idResults->at(i));
 
     for (unsigned i = 0; nameResults && i < nameResults->size(); ++i)
         result.append(nameResults->at(i));
 }
 
+HTMLCollection::NamedItemCache::NamedItemCache()
+{
+}
+
 } // namespace WebCore