From f9f9c42ab7ff967d272b1c59600a4396b199740b Mon Sep 17 00:00:00 2001
From: Josh Matthews <josh@joshmatthews.net>
Date: Thu, 14 Nov 2013 03:54:19 +0900
Subject: [PATCH 1/2] Ensure that it's safe to modify the DOM node pointers
 before doing so. Fixes #1224.

---
 src/components/script/dom/document.rs |  2 +-
 src/components/script/dom/element.rs  |  2 ++
 src/components/script/dom/node.rs     | 23 +++++++++++++++++------
 3 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/src/components/script/dom/document.rs b/src/components/script/dom/document.rs
index 08a0ee45763..648339f5c5b 100644
--- a/src/components/script/dom/document.rs
+++ b/src/components/script/dom/document.rs
@@ -274,7 +274,7 @@ impl Document {
                                 }
                                 has_title = true;
                                 for title_child in child.children() {
-                                    child.remove_child(title_child);
+                                    child.RemoveChild(title_child);
                                 }
                                 child.AppendChild(self.CreateTextNode(abstract_self, title.clone()));
                                 break;
diff --git a/src/components/script/dom/element.rs b/src/components/script/dom/element.rs
index 9ca8257eed5..01419401283 100644
--- a/src/components/script/dom/element.rs
+++ b/src/components/script/dom/element.rs
@@ -212,6 +212,8 @@ impl<'self> Element {
             None => {}
         }
 
+        self.node.wait_until_safe_to_modify_dom();
+
         // FIXME: reduce the time of `value.clone()`.
         let win = self.node.owner_doc().document().window;
         let new_attr = Attr::new_ns(win, local_name.clone(), value.clone(),
diff --git a/src/components/script/dom/node.rs b/src/components/script/dom/node.rs
index d21c994cb97..4741a267088 100644
--- a/src/components/script/dom/node.rs
+++ b/src/components/script/dom/node.rs
@@ -220,18 +220,28 @@ impl<View> TreeNodeRef<Node<View>> for AbstractNode<View> {
     }
 
     fn set_parent_node(node: &mut Node<View>, new_parent_node: Option<AbstractNode<View>>) {
+        let doc = node.owner_doc();
+        doc.document().wait_until_safe_to_modify_dom();
         node.parent_node = new_parent_node
     }
     fn set_first_child(node: &mut Node<View>, new_first_child: Option<AbstractNode<View>>) {
+        let doc = node.owner_doc();
+        doc.document().wait_until_safe_to_modify_dom();
         node.first_child = new_first_child
     }
     fn set_last_child(node: &mut Node<View>, new_last_child: Option<AbstractNode<View>>) {
+        let doc = node.owner_doc();
+        doc.document().wait_until_safe_to_modify_dom();
         node.last_child = new_last_child
     }
     fn set_prev_sibling(node: &mut Node<View>, new_prev_sibling: Option<AbstractNode<View>>) {
+        let doc = node.owner_doc();
+        doc.document().wait_until_safe_to_modify_dom();
         node.prev_sibling = new_prev_sibling
     }
     fn set_next_sibling(node: &mut Node<View>, new_next_sibling: Option<AbstractNode<View>>) {
+        let doc = node.owner_doc();
+        doc.document().wait_until_safe_to_modify_dom();
         node.next_sibling = new_next_sibling
     }
 
@@ -543,6 +553,10 @@ impl AbstractNode<ScriptView> {
         self.node().AppendChild(self, node)
     }
 
+    pub fn RemoveChild(self, node: AbstractNode<ScriptView>) -> Fallible<AbstractNode<ScriptView>> {
+        self.node().RemoveChild(self, node)
+    }
+
     // http://dom.spec.whatwg.org/#node-is-inserted
     fn node_inserted(self) {
         assert!(self.parent_node().is_some());
@@ -1072,8 +1086,6 @@ impl Node<ScriptView> {
     pub fn SetTextContent(&mut self,
                           abstract_self: AbstractNode<ScriptView>,
                           value: Option<DOMString>) -> ErrorResult {
-        self.wait_until_safe_to_modify_dom();
-
         let value = null_str_as_empty(&value);
         match self.type_id {
           DocumentFragmentNodeTypeId | ElementNodeTypeId(*) => {
@@ -1088,6 +1100,8 @@ impl Node<ScriptView> {
             Node::replace_all(node, abstract_self);
           }
           CommentNodeTypeId | TextNodeTypeId => {
+            self.wait_until_safe_to_modify_dom();
+
             do abstract_self.with_mut_characterdata() |characterdata| {
                 characterdata.data = value.clone();
 
@@ -1104,11 +1118,10 @@ impl Node<ScriptView> {
     pub fn InsertBefore(&self,
                         node: AbstractNode<ScriptView>,
                         child: Option<AbstractNode<ScriptView>>) -> Fallible<AbstractNode<ScriptView>> {
-        self.wait_until_safe_to_modify_dom();
         Node::pre_insert(node, node, child)
     }
 
-    fn wait_until_safe_to_modify_dom(&self) {
+    pub fn wait_until_safe_to_modify_dom(&self) {
         let document = self.owner_doc();
         document.document().wait_until_safe_to_modify_dom();
     }
@@ -1116,7 +1129,6 @@ impl Node<ScriptView> {
     pub fn AppendChild(&self,
                        abstract_self: AbstractNode<ScriptView>,
                        node: AbstractNode<ScriptView>) -> Fallible<AbstractNode<ScriptView>> {
-        self.wait_until_safe_to_modify_dom();
         Node::pre_insert(node, abstract_self, None)
     }
 
@@ -1127,7 +1139,6 @@ impl Node<ScriptView> {
     pub fn RemoveChild(&self,
                        abstract_self: AbstractNode<ScriptView>,
                        node: AbstractNode<ScriptView>) -> Fallible<AbstractNode<ScriptView>> {
-        self.wait_until_safe_to_modify_dom();
         Node::pre_remove(node, abstract_self)
     }
 

From b502f03fd6724e1026900df7eb87536fb9a47ec9 Mon Sep 17 00:00:00 2001
From: Josh Matthews <josh@joshmatthews.net>
Date: Sat, 16 Nov 2013 08:00:49 +0900
Subject: [PATCH 2/2] Add forgotten test for Element.attributes.

---
 .../html/content/test_element_attributes.html | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 src/test/html/content/test_element_attributes.html

diff --git a/src/test/html/content/test_element_attributes.html b/src/test/html/content/test_element_attributes.html
new file mode 100644
index 00000000000..c489fad9f87
--- /dev/null
+++ b/src/test/html/content/test_element_attributes.html
@@ -0,0 +1,21 @@
+<html>
+<head id="foo">
+  <script src="harness.js"></script>
+</head>
+<body>
+<div></div>
+<script>
+  var attrs = [];
+  for (var i = 'a'.charCodeAt(0); i != 'z'.charCodeAt(0); i++) {
+    document.getElementsByTagName('div')[0].setAttribute(String.fromCharCode(i),
+                                                      i.toString());
+  }
+  var attributes = document.getElementsByTagName('div')[0].attributes;
+  for (var i = 0; i < attributes.length; i++) {
+    is(attributes[i].name, String.fromCharCode(i + 'a'.charCodeAt(0)));
+    is(attributes[i].value, (i + 'a'.charCodeAt(0)).toString());
+  }
+  finish();
+</script>
+</body>
+</html>