From 018b4589620f2c6eea8b0c4c79496a5cb3191dc9 Mon Sep 17 00:00:00 2001
From: Andreas Kling <kling@serenityos.org>
Date: Thu, 22 Oct 2020 23:37:17 +0200
Subject: [PATCH] LibWeb: Make sure nodes are adopted when moving between
 documents

Otherwise, the "referencing node count" accounting won't be accurate,
and anything that accesses the document will be confused.
---
 Libraries/LibWeb/DOM/Node.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/Libraries/LibWeb/DOM/Node.cpp b/Libraries/LibWeb/DOM/Node.cpp
index a06a6e9e509..0e54aaddbb5 100644
--- a/Libraries/LibWeb/DOM/Node.cpp
+++ b/Libraries/LibWeb/DOM/Node.cpp
@@ -170,6 +170,8 @@ const Element* Node::parent_element() const
 
 RefPtr<Node> Node::append_child(NonnullRefPtr<Node> node, bool notify)
 {
+    if (&node->document() != &document())
+        document().adopt_node(node);
     TreeNode<Node>::append_child(node, notify);
     return node;
 }
@@ -182,6 +184,8 @@ RefPtr<Node> Node::insert_before(NonnullRefPtr<Node> node, RefPtr<Node> child, b
         dbg() << "FIXME: Trying to insert_before() a bogus child";
         return nullptr;
     }
+    if (&node->document() != &document())
+        document().adopt_node(node);
     TreeNode<Node>::insert_before(node, child, notify);
     return node;
 }
@@ -195,6 +199,10 @@ void Node::remove_all_children()
 
 void Node::set_document(Badge<Document>, Document& document)
 {
+    if (m_document == &document)
+        return;
+    document.ref_from_node({});
+    m_document->unref_from_node({});
     m_document = &document;
 }