Merge 88601

Source/WebCore/html/HTMLBodyElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 98 matching lines @@
     } else if (attr->name() == bgcolorAttr) {
         addCSSColor(attr, CSSPropertyBackgroundColor, attr->value());
     } else if (attr->name() == textAttr) {
         addCSSColor(attr, CSSPropertyColor, attr->value());
     } else if (attr->name() == bgpropertiesAttr) {
         if (equalIgnoringCase(attr->value(), "fixed"))
             addCSSProperty(attr, CSSPropertyBackgroundAttachment, CSSValueFixed);
     } else if (attr->name() == vlinkAttr ||
                attr->name() == alinkAttr ||
                attr->name() == linkAttr) {
+        // This tells us that we are removed from document. If our document is later destroyed
+        // (not deleted since we hold a guardRef), our stylesheet list will be null causing a crash
+        // later in document()->styleSelector(). So, we bail out early because we shouldn't be
+        // modifying anything in that document. See webkit bug 62230.
+        if (m_linkDecl && !m_linkDecl->parent())
+            return;
+
         if (attr->isNull()) {
             if (attr->name() == linkAttr)
                 document()->resetLinkColor();
             else if (attr->name() == vlinkAttr)
                 document()->resetVisitedLinkColor();
             else
                 document()->resetActiveLinkColor();
         } else {
             if (!m_linkDecl)
                 createLinkDecl();
@@ skipping 66 matching lines @@
             setAttribute(marginheightAttr, String::number(marginHeight));
     }
 
     // FIXME: This call to scheduleRelayout should not be needed here.
     // But without it we hang during WebKit tests; need to fix that and remove this.
     if (FrameView* view = document()->view())
         view->scheduleRelayout();
 
     if (document() && document()->page())
         document()->page()->updateViewportArguments();
+
+    if (m_linkDecl)
+        m_linkDecl->setParent(document()->elementSheet());
+}
+
+void HTMLBodyElement::removedFromDocument()
+{
+    if (m_linkDecl)
+        m_linkDecl->setParent(0);
+    
+    HTMLElement::removedFromDocument();
+}
+
+void HTMLBodyElement::didMoveToNewOwnerDocument()
+{
+    if (m_linkDecl)
+        m_linkDecl->setParent(document()->elementSheet());
+    
+    HTMLElement::didMoveToNewOwnerDocument();
 }
 
 bool HTMLBodyElement::isURLAttribute(Attribute *attr) const
 {
     return attr->name() == backgroundAttr;
 }
 
 bool HTMLBodyElement::supportsFocus() const
 {
     return rendererIsEditable() || HTMLElement::supportsFocus();
@@ skipping 123 matching lines @@
     return view ? adjustForZoom(view->contentsWidth(), document) : 0;    
 }
 
 void HTMLBodyElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
     HTMLElement::addSubresourceAttributeURLs(urls);
 
     addSubresourceURL(urls, document()->completeURL(getAttribute(backgroundAttr)));
 }
 
-void HTMLBodyElement::didMoveToNewOwnerDocument()
-{
-    // When moving body elements between documents, we should have to reset the parent sheet for any
-    // link style declarations.  If we don't we might crash later.
-    // In practice I can't reproduce this theoretical problem.
-    // webarchive/adopt-attribute-styled-body-webarchive.html tries to make sure this crash won't surface.
-    if (m_linkDecl)
-        m_linkDecl->setParent(document()->elementSheet());
-    
-    HTMLElement::didMoveToNewOwnerDocument();
-}
-
 } // namespace WebCore