angler-fishThe Vulnerability History Project

Reviewed by Darin Adler.

      https://bugs.webkit.org/show_bug.cgi?id=45205
        <rdar://problem/8391455> Detached elements shouldn't have style sheets.

        Tests: fast/dom/StyleSheet/detached-style-2.html
               fast/dom/StyleSheet/detached-style-pi.xhtml
               fast/dom/StyleSheet/detached-style.html
               fast/dom/StyleSheet/detached-style-pi-2.xhtml

        * bindings/js/JSStyleSheetCustom.cpp: (WebCore::JSStyleSheet::markChildren):
        There is no longer a need to mark owner nodes - StyleSheet->ownerNode() is only non-null when
        the node is in document.

        * css/StyleSheet.cpp: (WebCore::StyleSheet::StyleSheet): Added an assertion checking that
        all nodes that can be StyleSheet parents have been verified.

        * css/StyleSheet.h: (WebCore::StyleSheet::clearOwnerNode): Added.

        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::~ProcessingInstruction): Clear stylesheet's owner node. This
        shouldn't have observable effect, since a processing instruction that is in document can only
        be destroyed with document, and a reachable stylsheet keeps document alive.
        (WebCore::ProcessingInstruction::removedFromDocument): Clear the relationship between node and style sheet when removed.
        (WebCore::ProcessingInstruction::setCSSStyleSheet): If the element was removed during load, we still
        don't want to create a style sheet.

        * dom/StyleElement.cpp:
        (WebCore::StyleElement::sheet): There is no reason for lazy creation. It was a wrong fix for
        bug 14462, whose regression test still passes.
        (WebCore::StyleElement::removedFromDocument): Clear the relationship between node and style sheet when removed.
        (WebCore::StyleElement::finishParsingChildren): Don't call sheet(), it doens't have side effects any more.
        (WebCore::StyleElement::createSheet): Assert that the element is in document. We never want
    
commit 56d3dae3e51988ba04982b46b31eae658bcdb784
-23
-5
-31
-28
-5
-34
-16
-37
-60
+3
+37
+3
+33
-59
+8
-3
-18
-1
-11
-14
+12 -8
+1 -1
+1 -17
+5 -6
+1 -2
+5 -6
+1 -2
-6
-1
expand_less