Merge 122082 - Heap-use-after-free in WebCore::RenderObject::destroyAndCleanupAnonymousWrappers

Source/WebCore/html/HTMLSelectElement.cpp

 /*
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
@@ skipping 328 matching lines @@
 
 RenderObject* HTMLSelectElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     if (usesMenuList())
         return new (arena) RenderMenuList(this);
     return new (arena) RenderListBox(this);
 }
 
 bool HTMLSelectElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    return childContext.isOnUpperEncapsulationBoundary() && HTMLFormControlElementWithState::childShouldCreateRenderer(childContext);
+    if (!HTMLFormControlElementWithState::childShouldCreateRenderer(childContext))
+        return false;
+    if (!usesMenuList())
+        return true;
+    return validationMessageShadowTreeContains(childContext.node());
 }
 
 HTMLOptionsCollection* HTMLSelectElement::options()
 {
     if (!m_optionsCollection)
         m_optionsCollection = HTMLOptionsCollection::create(this);
     return m_optionsCollection.get();
 }
 
 void HTMLSelectElement::updateListItemSelectedStates()
@@ skipping 1183 matching lines @@
 
 const HTMLSelectElement* toHTMLSelectElement(const Node* node)
 {
     ASSERT(!node || node->hasTagName(selectTag));
     return static_cast<const HTMLSelectElement*>(node);
 }
 
 #endif
 
 } // namespace