Protect contextElement during insertAdjacentHTML call

Source/core/html/HTMLElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2011 Motorola Mobility. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 508 matching lines @@
     es.throwUninformativeAndGenericDOMException(SyntaxError);
     return 0;
 }
 
 void HTMLElement::insertAdjacentHTML(const String& where, const String& markup, ExceptionState& es)
 {
     Element* contextElement = contextElementForInsertion(where, this, es);
     if (!contextElement)
         return;
 
+    // Parsing can result in losing our last ref to contextElement when JS event handlers fire.
+    RefPtr<Element> protect = contextElement;

[inferno, 2013/11/10 09:10:46]

Please define the contextElement as RefPtr itself, no need of this line then.

Were you able to minimize the test ?

[davve, 2013/11/10 20:02:13]

OK.

+
     RefPtr<DocumentFragment> fragment = createFragmentForInnerOuterHTML(markup, contextElement, AllowScriptingContent, "insertAdjacentHTML", es);
     if (!fragment)
         return;
     insertAdjacent(where, fragment.get(), es);
 }
 
 void HTMLElement::insertAdjacentText(const String& where, const String& text, ExceptionState& es)
 {
     RefPtr<Text> textNode = document().createTextNode(text);
     insertAdjacent(where, textNode.get(), es);
@@ skipping 533 matching lines @@
 #ifndef NDEBUG
 
 // For use in the debugger
 void dumpInnerHTML(WebCore::HTMLElement*);
 
 void dumpInnerHTML(WebCore::HTMLElement* element)
 {
     printf("%s\n", element->innerHTML().ascii().data());
 }
 #endif