commit d75075ca0f3babd3a22c06d4b420c70f233b3758
author morrita@google.com <morrita@google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Thu Jan 20 01:24:40 2011 +0000
committer morrita@google.com <morrita@google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Thu Jan 20 01:24:40 2011 +0000
tree 8c39cac831312d06555b5c99b12755db263e9e37
parent c62b7fcd59e4939a922bce46757e2cd3ecc69a70

2011-01-18 MORITA Hajime <morrita@google.com>

        Reviewed by David Levin.

        ElementRareData::m_shadowRoot should not be RefPtr.
        https://bugs.webkit.org/show_bug.cgi?id=51914

        Makes ElementRareData::m_shadowRoot a raw pointer because
        ElementRareData::m_shadowRoot should be like a
        ContaineNode::m_firstChild, which is also a raw pointer.
        pointer. Which also means that both the shadow root and the shadow
        host reference each other as a parent-and-child relationship, via
        a raw pointer.

        Note that it is safe not to manipulate the ref-count of
        m_shadowRoot because Node::m_parent of the shadow root points its
        shadow host, and the object isn't deleted even if the refcount is
        zero, as long as the node has non-null m_parent. (See TreeShared.)

        The shadow root node is finally destroyed inside
        removeShadowRoot(), where we store the root node into a local
        RefPtr, then make the node's m_parent null, which results the
        destroy the node, at the end of the function, by RefPtr::~RefPtr.

        No new tests. No behavioral change.

        * dom/Element.cpp:
        (WebCore::Element::~Element):
        (WebCore::Element::shadowRoot):
        (WebCore::Element::setShadowRoot):
        (WebCore::Element::removeShadowRoot):
        * dom/ElementRareData.h:
        (WebCore::ElementRareData::ElementRareData):
        (WebCore::ElementRareData::~ElementRareData):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@76183 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/dom/ElementRareData.h

diff --git a/Source/WebCore/dom/ElementRareData.h b/Source/WebCore/dom/ElementRareData.h
index f7f30bb..818a2c2 100644
--- a/Source/WebCore/dom/ElementRareData.h
+++ b/Source/WebCore/dom/ElementRareData.h
@@ -33,6 +33,7 @@
 class ElementRareData : public NodeRareData {
 public:
     ElementRareData();
+    virtual ~ElementRareData();
 
     void resetComputedStyle();
 
@@ -41,7 +42,7 @@
 
     IntSize m_minimumSizeForResizing;
     RefPtr<RenderStyle> m_computedStyle;
-    RefPtr<Node> m_shadowRoot;
+    Node* m_shadowRoot;
 
     OwnPtr<DatasetDOMStringMap> m_datasetDOMStringMap;
     OwnPtr<ClassList> m_classList;
@@ -54,9 +55,15 @@
 
 inline ElementRareData::ElementRareData()
     : m_minimumSizeForResizing(defaultMinimumSizeForResizing())
+    , m_shadowRoot(0)
 {
 }
 
+inline ElementRareData::~ElementRareData()
+{
+    ASSERT(!m_shadowRoot);
+}
+
 inline void ElementRareData::resetComputedStyle()
 {
     m_computedStyle.clear();