angler-fishThe Vulnerability History Project

Revert 148127 &quotSimplify ContainerNode::removeChildren and make i...&quot

      > Simplify ContainerNode::removeChildren and make it faster
> 
> Simplify ContainerNode::removeChildren by merging the loops and removing
> willRemoveChildren. This removes 3+ traversals of the children, avoids
> refing and derefing all the children once, avoids allocating a second
> NodeVector of children, and means we detach() in the same order as
> normal removal.
> 
> This does mean you can get into an infinite loop with DOMNodeRemoved
> listeners by continously adding nodes but this is true in all other browsers
> and the current behavior is bad because it means you don't get notified
> of nodes added during removal (which other browsers do notify of). This
> patch removes the containerNode.html test that originally tested for this
> infinite loop and adds a new one that tests that all nodes get notified.
> 
> This makes PerformanceTests/Parser/innerHTML-setter.html 2-6% faster.
> 
> There's also a new test verifying ranges remain consistent if modified
> inside an mutation event handler. Without the patch it's possible to create
> a range with boundaries outside of the DOM tree. This test was imported from
> https://bugs.webkit.org/show_bug.cgi?id=113517 and written by Andrei
> Bucur who landed a modified version of my patch in WebKit.
> 
> Review URL: https://codereview.chromium.org/13901002

This causes use after frees inside the Widget tree, and also inside
node lists and other things because we allow script to run before
updating the widget tre or calling childrenChanged or calling the
ChildNodeRemovalNotifier. We need to reconsider how this works.

TBR=esprehn@chromium.org
Review URL: https://codereview.chromium.org/13874006

git-svn-id: svn://svn.chromium.org/blink/trunk@148250 bbb929c8-8fbe-4397-9dbb-9b2b20218538
    
commit 9aa4146da55802fe5ececfa528d3bb97d51a59c2
+8 -9
+8 -9
+10
+39
-1
-46
+3
+25
+27 -58
-23
-2
-25
-1
expand_less