From eb9932430c3c05f7b38b7a8a8acdc0ffe3f7edd5 Mon Sep 17 00:00:00 2001 From: "sigbjornf@opera.com" Date: Sun, 23 Aug 2015 23:34:27 +0000 Subject: [PATCH] Accurately update Document node counts on disposing shadow roots. When cleaning out a ShadowRoot's child Nodes as part of its disposal, the child Nodes will in some cases not have other references than the shadow root. If so, the Node will be summarily deleted without being notified of it being removed from its DOM tree first. By calling its removedFrom(). As a Document need to maintain an accurate attached node count, arrange for the otherwise-unreferenced Node's document to be decremented. R= BUG=521520 Review URL: https://codereview.chromium.org/1309083002 git-svn-id: svn://svn.chromium.org/blink/trunk@201044 bbb929c8-8fbe-4397-9dbb-9b2b20218538 --- third_party/WebKit/Source/core/dom/ContainerNode.cpp | 3 +++ third_party/WebKit/Source/core/dom/Document.cpp | 1 - 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/third_party/WebKit/Source/core/dom/ContainerNode.cpp b/third_party/WebKit/Source/core/dom/ContainerNode.cpp index 90fb8b95765b..5a44e55d67cb 100644 --- a/third_party/WebKit/Source/core/dom/ContainerNode.cpp +++ b/third_party/WebKit/Source/core/dom/ContainerNode.cpp @@ -513,6 +513,9 @@ void ContainerNode::addChildNodesToDeletionQueue(Node*& head, Node*& tail, Conta next->setPreviousSibling(nullptr); if (!n->refCount()) { + if (n->inDocument()) + container.document().decrementNodeCount(); + #if ENABLE(SECURITY_ASSERT) n->m_deletionHasBegun = true; #endif diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp index b64db4415dd2..b624312af7e4 100644 --- a/third_party/WebKit/Source/core/dom/Document.cpp +++ b/third_party/WebKit/Source/core/dom/Document.cpp @@ -596,7 +596,6 @@ void Document::dispose() DocumentLifecycleNotifier::notifyDocumentWasDisposed(); m_canvasFontCache.clear(); - m_nodeCount = 0; } #endif -- 2.11.4.GIT