Merge 66862 - 2010-09-06 Adam Barth <abarth@webkit.org>...

WebCore/dom/Element.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 677 matching lines @@
                 if (isEventHandlerAttribute(attributeName)) {
                     m_attributeMap->m_attributes.remove(i);
                     continue;
                 }
 
                 if (isAttributeToRemove(attributeName, m_attributeMap->m_attributes[i]->value()))
                     m_attributeMap->m_attributes[i]->setValue(nullAtom);
                 i++;
             }
         }
-        unsigned len = m_attributeMap->length();
-        for (unsigned i = 0; i < len; i++)
-            attributeChanged(m_attributeMap->m_attributes[i].get());
+        // Store the set of attributes that changed on the stack in case
+        // attributeChanged mutates m_attributeMap.
+        Vector<RefPtr<Attribute> > attributes;
+        m_attributeMap->copyAttributesToVector(attributes);
+        for (Vector<RefPtr<Attribute> >::iterator iter = attributes.begin(); iter != attributes.end(); ++iter)
+            attributeChanged(iter->get());
         // FIXME: What about attributes that were in the old map that are not in the new map?
     }
 }
 
 bool Element::hasAttributes() const
 {
     if (!isStyleAttributeValid())
         updateStyleAttribute();
 
 #if ENABLE(SVG)
@@ skipping 905 matching lines @@
 #endif
     
 #if ENABLE(FULLSCREEN_API)
 void Element::webkitRequestFullScreen(unsigned short flags)
 {
     document()->webkitRequestFullScreenForElement(this, flags);
 }
 #endif    
 
 } // namespace WebCore