Bug 51079

Summary: Possible infinite loop in ContainerNode::willRemoveChildren
Product: WebKit Reporter: Emil A Eklund <eae>
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: abarth, commit-queue, eric, esprehn, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
Patch none

Emil A Eklund
Reported 2010-12-14 17:50:05 PST
Adding children to ContainerNode in a DOMNodeRemoved event handler triggers an infinite loop in ContainerNode::willRemoveChildren.
Attachments
Patch (4.15 KB, patch)
2010-12-14 17:51 PST, Emil A Eklund 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Emil A Eklund
Comment 1 2010-12-14 17:51:25 PST
Created attachment 76604 [details] Patch
WebKit Commit Bot
Comment 2 2010-12-15 01:45:32 PST
The commit-queue encountered the following flaky tests while processing attachment 76604 [details]: http/tests/navigation/target-frame-from-window.html bug 51098 (author: ddkilzer@webkit.org) The commit-queue is continuing to process your patch.
WebKit Commit Bot
Comment 3 2010-12-15 01:47:30 PST
Comment on attachment 76604 [details] Patch Clearing flags on attachment: 76604 Committed r74101: <http://trac.webkit.org/changeset/74101>
WebKit Commit Bot
Comment 4 2010-12-15 01:47:35 PST
All reviewed patches have been landed. Closing bug.
WebKit Review Bot
Comment 5 2010-12-15 05:58:40 PST
http://trac.webkit.org/changeset/74101 might have broken GTK Linux 64-bit Debug
Elliott Sprehn
Comment 6 2013-03-28 19:27:50 PDT
What was the reason for this fix? Gecko and Opera both end up in an infinite loop here so it's not clear avoiding it makes sense, and avoiding it added some complication to the algorithm (and more iterations over the children).
Note You need to log in before you can comment on or make changes to this bug.