Call insertedInto or removedFrom before childrenChanged

Source/core/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 285 matching lines @@
 void ContainerNode::parserInsertBefore(PassRefPtrWillBeRawPtr<Node> newChild, Node& nextChild)
 {
     ASSERT(newChild);
     ASSERT(nextChild.parentNode() == this);
     ASSERT(!newChild->isDocumentFragment());
     ASSERT(!isHTMLTemplateElement(this));
 
     if (nextChild.previousSibling() == newChild || &nextChild == newChild) // nothing to do
         return;
 
+    RefPtrWillBeRawPtr<Node> protect(this);
+
     if (document() != newChild->document())
         document().adoptNode(newChild.get(), ASSERT_NO_EXCEPTION);
 
     insertBeforeCommon(nextChild, *newChild);
 
     newChild->updateAncestorConnectedSubframeCountForInsertion();
 
     ChildListMutationScope(*this).childAdded(*newChild);
 
-    ChildrenChange change = {ChildInserted, newChild->previousSibling(), &nextChild, ChildrenChangeSourceParser};
-    childrenChanged(change);
-
-    notifyNodeInserted(*newChild);
+    notifyNodeInserted(*newChild, ChildrenChangeSourceParser);
 }
 
 PassRefPtrWillBeRawPtr<Node> ContainerNode::replaceChild(PassRefPtrWillBeRawPtr<Node> newChild, PassRefPtrWillBeRawPtr<Node> oldChild, ExceptionState& exceptionState)
 {
 #if !ENABLE(OILPAN)
     // Check that this node is not "floating".
     // If it is, it can be deleted as a side effect of sending mutation events.
     ASSERT(refCount() || parentOrShadowHostNode());
 #endif
 
@@ skipping 232 matching lines @@
         exceptionState.throwDOMException(NotFoundError, "The node to be removed is no longer a child of this node. Perhaps it was moved in response to a mutation?");
         return nullptr;
     }
 
     {
         HTMLFrameOwnerElement::UpdateSuspendScope suspendWidgetHierarchyUpdates;
 
         Node* prev = child->previousSibling();
         Node* next = child->nextSibling();
         removeBetween(prev, next, *child);
+        notifyNodeRemoved(*child);
         ChildrenChange change = {ChildRemoved, prev, next, ChildrenChangeSourceAPI};
         childrenChanged(change);
-        notifyNodeRemoved(*child);
     }
     dispatchSubtreeModifiedEvent();
     return child;
 }
 
 void ContainerNode::removeBetween(Node* previousChild, Node* nextChild, Node& oldChild)
 {
     NoEventDispatchAssertion assertNoEventDispatch;
 
     ASSERT(oldChild.parentNode() == this);
@@ skipping 26 matching lines @@
     Node* next = oldChild.nextSibling();
 
     oldChild.updateAncestorConnectedSubframeCountForRemoval();
 
     ChildListMutationScope(*this).willRemoveChild(oldChild);
     oldChild.notifyMutationObserversNodeWillDetach();
 
     removeBetween(prev, next, oldChild);
 
     ChildrenChange change = {ChildRemoved, prev, next, ChildrenChangeSourceParser};
+    notifyNodeRemoved(oldChild);
     childrenChanged(change);
-    notifyNodeRemoved(oldChild);
 }
 
 // this differs from other remove functions because it forcibly removes all the children,
 // regardless of read-only status or event exceptions, e.g.
 void ContainerNode::removeChildren()
 {
     if (!m_firstChild)
         return;
 
     // The container node can be removed from event handlers.
@@ skipping 14 matching lines @@
         // Exclude this node when looking for removed focusedElement since only
         // children will be removed.
         // This must be later than willRemoveChildren, which might change focus
         // state of a child.
         document().removeFocusedElementOfSubtree(this, true);
 
         // Removing a node from a selection can cause widget updates.
         document().nodeChildrenWillBeRemoved(*this);
     }
 
-
+    // FIXME: Remove this NodeVector. Right now WebPluginContainerImpl::m_element is a
+    // raw ptr which means the code below can drop the last ref to a plugin element and
+    // then the code in UpdateSuspendScope::performDeferredWidgetTreeOperations will
+    // try to destroy the plugin which will be a use-after-free. We should use a RefPtr
+    // in the WebPluginContainerImpl instead.
     NodeVector removedChildren;
     {
         HTMLFrameOwnerElement::UpdateSuspendScope suspendWidgetHierarchyUpdates;
+
         {
             NoEventDispatchAssertion assertNoEventDispatch;
-            removedChildren.reserveInitialCapacity(countChildren());
-            while (m_firstChild) {
-                removedChildren.append(m_firstChild);
-                removeBetween(0, m_firstChild->nextSibling(), *m_firstChild);
+            ScriptForbiddenScope forbidScript;
+
+            removedChildren.reserveInitialCapacity(childNodeCount());
+
+            while (RefPtrWillBeRawPtr<Node> child = m_firstChild) {
+                removeBetween(0, child->nextSibling(), *child);
+                removedChildren.append(child.get());
+                notifyNodeRemoved(*child);
             }
         }
 
         ChildrenChange change = {AllChildrenRemoved, nullptr, nullptr, ChildrenChangeSourceAPI};
         childrenChanged(change);
-
-        for (size_t i = 0; i < removedChildren.size(); ++i)
-            notifyNodeRemoved(*removedChildren[i]);
     }
 
     dispatchSubtreeModifiedEvent();
 }
 
 PassRefPtrWillBeRawPtr<Node> ContainerNode::appendChild(PassRefPtrWillBeRawPtr<Node> newChild, ExceptionState& exceptionState)
 {
     RefPtrWillBeRawPtr<ContainerNode> protect(this);
 
 #if !ENABLE(OILPAN)
@@ skipping 57 matching lines @@
     return newChild;
 }
 
 void ContainerNode::parserAppendChild(PassRefPtrWillBeRawPtr<Node> newChild)
 {
     ASSERT(newChild);
     ASSERT(!newChild->parentNode()); // Use appendChild if you need to handle reparenting (and want DOM mutation events).
     ASSERT(!newChild->isDocumentFragment());
     ASSERT(!isHTMLTemplateElement(this));
 
+    RefPtrWillBeRawPtr<Node> protect(this);

[adamk, 2014/07/24 21:35:59]

What's this about?

[esprehn, 2014/07/24 22:50:18]

Nothing is protecting |this| in these parser methods like in the non-parser ones
even though they run script. I added the protects just like in my original patch
(which you also reviewed). I guess I can leave that out?

+
     if (document() != newChild->document())
         document().adoptNode(newChild.get(), ASSERT_NO_EXCEPTION);
 
-    Node* last = m_lastChild;
-
     {
         NoEventDispatchAssertion assertNoEventDispatch;
         ScriptForbiddenScope forbidScript;
 
         treeScope().adoptIfNeeded(*newChild);
         appendChildCommon(*newChild);
         newChild->updateAncestorConnectedSubframeCountForInsertion();
         ChildListMutationScope(*this).childAdded(*newChild);
     }
 
-    ChildrenChange change = {ChildInserted, last, nullptr, ChildrenChangeSourceParser};
-    childrenChanged(change);
-    notifyNodeInserted(*newChild);
+    notifyNodeInserted(*newChild, ChildrenChangeSourceParser);
 }
 
-void ContainerNode::notifyNodeInserted(Node& root)
+void ContainerNode::notifyNodeInserted(Node& root, ChildrenChangeSource source)
 {
     ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
 
     InspectorInstrumentation::didInsertDOMNode(&root);
 
     RefPtrWillBeRawPtr<Node> protect(this);
     RefPtrWillBeRawPtr<Node> protectNode(root);
 
     NodeVector postInsertionNotificationTargets;
     notifyNodeInsertedInternal(root, postInsertionNotificationTargets);
 
+    // ShadowRoots are not real children, we don't need to tell host that it's

[adamk, 2014/07/24 21:35:59]

Why are you changing this behavior in this patch? It seems unrelated...

[esprehn, 2014/07/24 22:50:18]

I'm not changing any behavior, I moved childrenChanged into notifyNodeInserted
which means we'd call childrenChanged on ShadowRoot's since
ElementShadow::addShadowRoot calls notifyNodeInserted(), but calling
childrenChanged on a ShadowRoot right when it's created is not correct and would
change behavior.

+    // children changed when one is added.
+    // FIXME: We should have a separate code path for ShadowRoot since it only
+    // needs to call insertedInto and the rest of this logic is not needed.
+    if (!root.isShadowRoot()) {
+        ChildrenChange change = {ChildInserted, root.previousSibling(), root.nextSibling(), source};
+        childrenChanged(change);
+    }
+
     for (size_t i = 0; i < postInsertionNotificationTargets.size(); ++i) {
         Node* targetNode = postInsertionNotificationTargets[i].get();
         if (targetNode->inDocument())
             targetNode->didNotifySubtreeInsertionsToDocument();
     }
 }
 
 void ContainerNode::notifyNodeInsertedInternal(Node& root, NodeVector& postInsertionNotificationTargets)
 {
     NoEventDispatchAssertion assertNoEventDispatch;
@@ skipping 391 matching lines @@
 
 void ContainerNode::updateTreeAfterInsertion(Node& child)
 {
 #if !ENABLE(OILPAN)
     ASSERT(refCount());
     ASSERT(child.refCount());
 #endif
 
     ChildListMutationScope(*this).childAdded(child);
 
-    ChildrenChange change = {ChildInserted, child.previousSibling(), child.nextSibling(), ChildrenChangeSourceAPI};
-    childrenChanged(change);
-
     notifyNodeInserted(child);
 
     dispatchChildInsertionEvents(child);
 }
 
 bool ContainerNode::hasRestyleFlagInternal(DynamicRestyleFlags mask) const
 {
     return rareData()->hasRestyleFlag(mask);
 }
 
@@ skipping 180 matching lines @@
         return true;
 
     if (node->isElementNode() && toElement(node)->shadow())
         return true;
 
     return false;
 }
 #endif
 
 } // namespace blink