Make TreeScopeEventContext have a RefPtr to TreeScope.rootNode to guard TreeScope.

Make TreeScopeEventContext have a RefPtr to TreeScope.rootNode to guard TreeScope.

This fixes a use-after-free caused by TreeScope being freed while TreeScopeEventContext still needs it.
Because TreeScope itself isn't a RefCounted, guard it by having a RefPtr to treeScope.rootNode(), instead.

BUG=442806
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=187435

[hayato, 2014-12-17 11:20:46]

hayato@chromium.org changed reviewers:
+ dglazkov@chromium.org, esprehn@chromium.org

[hayato, 2014-12-17 11:20:47]

PTAL

[dglazkov, 2014-12-17 16:48:55]

lgtm

https://codereview.chromium.org/794123004/diff/1/LayoutTests/fast/dom/shadow/...
File LayoutTests/fast/dom/shadow/event-path-after-deleting-tree-scope-crash.html
(right):

https://codereview.chromium.org/794123004/diff/1/LayoutTests/fast/dom/shadow/...
LayoutTests/fast/dom/shadow/event-path-after-deleting-tree-scope-crash.html:6:
doc = document.implementation.createDocument('.', 'doc', docType);
Interesting! Why is it significant to have this constructed as an XHTML doc, and
not just document.implementation.createHTMLDocument?

[hayato, 2014-12-18 05:54:29]

Thank you for the review.

https://codereview.chromium.org/794123004/diff/1/LayoutTests/fast/dom/shadow/...
File LayoutTests/fast/dom/shadow/event-path-after-deleting-tree-scope-crash.html
(right):

https://codereview.chromium.org/794123004/diff/1/LayoutTests/fast/dom/shadow/...
LayoutTests/fast/dom/shadow/event-path-after-deleting-tree-scope-crash.html:6:
doc = document.implementation.createDocument('.', 'doc', docType);
On 2014/12/17 16:48:55, dglazkov - afk until Jan 5 wrote:
> Interesting! Why is it significant to have this constructed as an XHTML doc,
and
> not just document.implementation.createHTMLDocument?

Yeah, there is no reason to use XHTML here.

This test case is from the cruster-fuzzer and I wasn't aware that I could use
document.implementation.createHTMLDocument instead here.

Let me land the patch after simplifying the HTML further.

[hayato, 2014-12-18 05:54:49]

The CQ bit was checked by hayato@chromium.org

[commit-bot: I haz the power, 2014-12-18 05:55:53]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/794123004/20001

[commit-bot: I haz the power, 2014-12-18 07:06:53]

Committed patchset #2 (id:20001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=187435