Reviewed by Maciej.
- fixed http://bugzilla.opendarwin.org/show_bug.cgi?id=4367
Crash when executing setTimeout / Date / document.write Javascript (bugtraq)
Test cases added:
* layout-tests/fast/dom/document-write-infinite-recursion.html: Added.
* layout-tests/fast/dom/document-write-infinite-recursion-expected.txt: Added.
* khtml/xml/dom_docimpl.cpp:
(DocumentImpl::implicitClose): Simplify a bit to make more readable. Remove the
code to delete the tokenizer an extra time -- that can end up deleting the newly
created tokenizer that's still needed for the newly opened page.
(DocumentImpl::write): Added an assertion to catch the badness that caused
infinite recursion so it's easier to recognize next time.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@10513 268f45cc-cd09-0410-ab3c-d52691b4dbfc
4 files changed
