Unreviewed, rolling out r139096.
http://trac.webkit.org/changeset/139096
https://bugs.webkit.org/show_bug.cgi?id=106367

not a complete fix (Requested by bweinstein on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2013-01-08

* html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::userDidClickSnapshot):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139099 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Heap-use-after-free in bool WebCore::SelectorChecker::checkOneSelector.
<http://webkit.org/b/105834>

Reviewed by Antti Koivisto.

Source/WebCore:

Suppress the DOMSubtreeModified event when synchronizing the "style" attribute and we've
instantiated an Attr node wrapper for the said attribute.

Also added an assertion that Document's StyleResolver isn't cleared during style recalc,
which will help us catch this kind of bug in the future.

Test: fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html

* dom/Document.cpp:
(WebCore::Document::styleResolverThrowawayTimerFired):
* dom/Element.cpp:
(WebCore::Element::setAttributeInternal):

LayoutTests:

* fast/dom/mutation-event-listener-with-dirty-inline-style-crash-expected.txt: Added.
* fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139100 268f45cc-cd09-0410-ab3c-d52691b4dbfc