https://bugs.webkit.org/show_bug.cgi?id=207875
<rdar://58976682>
Patch by Sunny He <sunny_he@apple.com> on 2020-02-19
Reviewed by Ryosuke Niwa.
When Node::normalize() merges two text nodes, it calls appendData
before textNodesMerged. If there is a mutator event registered, it
will fire on the call to appendData, potentially changing the child
order and causing a nullptr crash due to incorrect sibling pointers.
Reverse the order of these calls to ensure order gets correctly
updated.
Source/WebCore:
Test: fast/dom/Node/normalize-mutation-event.html
* dom/Node.cpp:
(WebCore::Node::normalize):
LayoutTests:
* fast/dom/Node/normalize-mutation-event-expected.txt: Added.
* fast/dom/Node/normalize-mutation-event.html: Added.
Canonical link: https://commits.webkit.org/220951@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@257036 268f45cc-cd09-0410-ab3c-d52691b4dbfc
