Fix possible crash in Element::normalizeAttributes()

Source/core/dom/Element.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012, 2013 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 2515 matching lines @@
 void Element::cancelFocusAppearanceUpdate()
 {
     if (document().focusedElement() == this)
         document().cancelFocusAppearanceUpdate();
 }
 
 void Element::normalizeAttributes()
 {
     if (!hasAttributes())
         return;
-    // attributeCount() cannot be cached before the loop because the attributes
-    // list is altered while iterating.
-    AttributeCollection attributes = this->attributes();
-    AttributeCollection::const_iterator end = attributes.end();
-    for (AttributeCollection::const_iterator it = attributes.begin(); it < end; ++it) {
-        if (RefPtrWillBeRawPtr<Attr> attr = attrIfExists(it->name()))
-            attr->normalize();
-    }
+    WillBeHeapVector<RefPtrWillBeMember<Attr> >* attrNodes = attrNodeList();
+    if (!attrNodes)
+        return;
+    // Copy the Attr Vector because Node::normalize() can fire synchronous JS
+    // events (e.g. DOMSubtreeModified) and a JS listener could add / remove
+    // attributes while we are iterating.
+    WillBeHeapVector<RefPtrWillBeMember<Attr> > attrNodesCopy(*attrNodes);
+    for (size_t i = 0; i < attrNodesCopy.size(); ++i)
+        attrNodesCopy[i]->normalize();
 }
 
 void Element::updatePseudoElement(PseudoId pseudoId, StyleRecalcChange change)
 {
     ASSERT(!needsStyleRecalc());
     PseudoElement* element = pseudoElement(pseudoId);
     if (element && (change == UpdatePseudoElements || element->shouldCallRecalcStyle(change))) {
 
         // Need to clear the cached style if the PseudoElement wants a recalc so it
         // computes a new style.
@@ skipping 799 matching lines @@
 
 void Element::trace(Visitor* visitor)
 {
     if (hasRareData())
         visitor->trace(elementRareData());
     visitor->trace(m_elementData);
     ContainerNode::trace(visitor);
 }
 
 } // namespace WebCore