Bug 87746 – [Chromium] Remove assertions on state in Prerender.cpp

• Component: New Bugs
• Status: RESOLVED FIXED

[Gavin Peters]

Remove aassertions on state in Prerender.cpp

[Gavin Peters]

Created attachment 144559 [details]
Patch

[Gavin Peters]

Comment on attachment 144559 [details]
Patch

abarth, WDYT?

I'm most interested in knowing if I was really overzealous with my assertions like I thought: the alternative is that something freaky is happen by calling HTMLElement::removedFromDocument() after the DOM is stopped.

[Adam Barth]

Comment on attachment 144559 [details]
Patch

I talked with Gavin directly abou this patch.  Here's what I said:

[[[
Yes, that's entirely possible.
The way this can happen is you take a reference to a DOM node in an
iframe and then either navigate to iframe to a new URL or remove the
iframe from the DOM entirely.  Now, stop() will be called on the DOM
node, but it will still be in the DOM tree.  You can then remove it
from the DOM tree using removeChild.
]]]

He's going to write a test for this in the Chromium repo where it can be an end-to-end test.  Ideally, we'd have a LayoutTest too, but Gavin tells me that there's not enough of the prerendering machinery in DumpRenderTree for that to be a meaningful test.

Gavin, once you add the test to Chromium, can you include a link in this bug?

[WebKit Review Bot]

Comment on attachment 144559 [details]
Patch

Clearing flags on attachment: 144559

Committed r118848: <http://trac.webkit.org/changeset/118848>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.

[Gavin Peters]

I opted to add enough machinery to DumpRenderTree to let this be tested; see https://bugs.webkit.org/show_bug.cgi?id=87860 for the new Mocks and the layout test for this issue.