commit c2896149302b74b49c7adc03ae62421c27ec2990
author adamk@chromium.org <adamk@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Sat Sep 22 01:27:52 2012 +0000
committer adamk@chromium.org <adamk@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Sat Sep 22 01:27:52 2012 +0000
tree 3217e9b71efd9768819503d55963afab1f6000e4
parent 094dbd98dff79bced23f2317514c18e7fccd47a6

Remove bogus assertions from ChildListMutationScope
https://bugs.webkit.org/show_bug.cgi?id=97372

Reviewed by Ryosuke Niwa.

Source/WebCore:

Some asserts (and their accompanying comment) were trying to enforce
proper usage of ChildListMutationScope from WebCore, but in the
presence of MutationEvents they could fail due to arbitrary script
execution.

This change gets rid of those asserts and adds tests exercising
the (pre-existing) codepaths for handling these out-of-order cases.
Without this patch, these tests ASSERT in debug builds.

Tests: fast/mutation/added-out-of-order.html
       fast/mutation/removed-out-of-order.html

* dom/ChildListMutationScope.cpp:
(WebCore::ChildListMutationAccumulator::childAdded):
(WebCore::ChildListMutationAccumulator::willRemoveChild):
* dom/ChildListMutationScope.h:
(WebCore):

LayoutTests:

* fast/mutation/added-out-of-order-expected.txt: Added.
* fast/mutation/added-out-of-order.html: Added.
* fast/mutation/removed-out-of-order-expected.txt: Added.
* fast/mutation/removed-out-of-order.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129288 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/dom/ChildListMutationScope.cpp

diff --git a/Source/WebCore/dom/ChildListMutationScope.cpp b/Source/WebCore/dom/ChildListMutationScope.cpp
index bdff209..44762bd 100644
--- a/Source/WebCore/dom/ChildListMutationScope.cpp
+++ b/Source/WebCore/dom/ChildListMutationScope.cpp
@@ -87,10 +87,10 @@
 
 void ChildListMutationAccumulator::childAdded(PassRefPtr<Node> prpChild)
 {
+    ASSERT(hasObservers());
+
     RefPtr<Node> child = prpChild;
 
-    ASSERT(hasObservers());
-    ASSERT(isAddedNodeInOrder(child.get()));
     if (!isAddedNodeInOrder(child.get()))
         enqueueMutationRecord();
 
@@ -110,10 +110,10 @@
 
 void ChildListMutationAccumulator::willRemoveChild(PassRefPtr<Node> prpChild)
 {
+    ASSERT(hasObservers());
+
     RefPtr<Node> child = prpChild;
 
-    ASSERT(hasObservers());
-    ASSERT(m_addedNodes.isEmpty() && isRemovedNodeInOrder(child.get()));
     if (!m_addedNodes.isEmpty() || !isRemovedNodeInOrder(child.get()))
         enqueueMutationRecord();