Make sure named item cache is always valid HTMLCollection::updateIdNameCache()

Source/core/html/HTMLFormControlsCollection.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2014 Samsung Electronics. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 135 matching lines @@
         return item;
 
     return firstNamedItem(formControlElements(), imagesElements, nameAttr, name);
 }
 
 void HTMLFormControlsCollection::updateIdNameCache() const
 {
     if (hasValidIdNameCache())
         return;
 
-    NamedItemCache& cache = createNamedItemCache();
+    OwnPtr<NamedItemCache> cache = NamedItemCache::create();
     HashSet<StringImpl*> foundInputElements;
 
     const Vector<FormAssociatedElement*>& elementsArray = formControlElements();
 
     for (unsigned i = 0; i < elementsArray.size(); ++i) {
         FormAssociatedElement* associatedElement = elementsArray[i];
         if (associatedElement->isEnumeratable()) {
             HTMLElement* element = toHTMLElement(associatedElement);
             const AtomicString& idAttrVal = element->getIdAttribute();
             const AtomicString& nameAttrVal = element->getNameAttribute();
             if (!idAttrVal.isEmpty()) {
-                cache.addElementWithId(idAttrVal, element);
+                cache->addElementWithId(idAttrVal, element);
                 foundInputElements.add(idAttrVal.impl());
             }
             if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal) {
-                cache.addElementWithName(nameAttrVal, element);
+                cache->addElementWithName(nameAttrVal, element);
                 foundInputElements.add(nameAttrVal.impl());
             }
         }
     }
 
     if (isHTMLFormElement(ownerNode())) {
         const Vector<HTMLImageElement*>& imageElementsArray = formImageElements();
         for (unsigned i = 0; i < imageElementsArray.size(); ++i) {
             HTMLImageElement* element = imageElementsArray[i];
             const AtomicString& idAttrVal = element->getIdAttribute();
             const AtomicString& nameAttrVal = element->getNameAttribute();
             if (!idAttrVal.isEmpty() && !foundInputElements.contains(idAttrVal.impl()))
-                cache.addElementWithId(idAttrVal, element);
+                cache->addElementWithId(idAttrVal, element);
             if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal && !foundInputElements.contains(nameAttrVal.impl()))
-                cache.addElementWithName(nameAttrVal, element);
+                cache->addElementWithName(nameAttrVal, element);
         }
     }
+
+    // Set the named item cache last as traversing the tree may cause cache invalidation.
+    setNamedItemCache(cache.release());
 }
 
 void HTMLFormControlsCollection::namedGetter(const AtomicString& name, bool& radioNodeListEnabled, RefPtr<RadioNodeList>& radioNodeList, bool& elementEnabled, RefPtr<Element>& element)
 {
     Vector<RefPtr<Element> > namedItems;
     this->namedItems(name, namedItems);
 
     if (namedItems.isEmpty())
         return;
 
@@ skipping 28 matching lines @@
         const AtomicString& nameAttribute = element->getNameAttribute();
         if (!nameAttribute.isEmpty()) {
             HashSet<AtomicString>::AddResult addResult = existingNames.add(nameAttribute);
             if (addResult.isNewEntry)
                 names.append(nameAttribute);
         }
     }
 }
 
 }