1 files changed, 35 insertions, 11 deletions

diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTaskElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLTaskElement.cpp
index 1add1da79..d49a03e2f 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTaskElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTaskElement.cpp
@@ -48,8 +48,6 @@ void WMLTaskElement::insertedIntoDocument()
     WMLElement::insertedIntoDocument();
 
     Node* parent = parentNode();
-    ASSERT(parent);
-
     if (!parent || !parent->isWMLElement())
         return;
 
@@ -61,10 +59,32 @@ void WMLTaskElement::insertedIntoDocument()
         static_cast<WMLOnEventElement*>(parent)->registerTask(this);
 }
 
+void WMLTaskElement::removedFromDocument()
+{
+    Node* parent = parentNode();
+    if (parent && parent->isWMLElement()) {
+        if (parent->hasTagName(anchorTag))
+            static_cast<WMLAnchorElement*>(parent)->deregisterTask(this);
+        else if (parent->hasTagName(doTag))
+            static_cast<WMLDoElement*>(parent)->deregisterTask(this);
+        else if (parent->hasTagName(oneventTag))
+            static_cast<WMLOnEventElement*>(parent)->deregisterTask(this);
+    }
+
+    WMLElement::removedFromDocument();
+}
+
 void WMLTaskElement::registerVariableSetter(WMLSetvarElement* element)
 {
-    ASSERT(element);
-    m_variableSetterElements.add(element);
+    ASSERT(m_variableSetterElements.find(element) == WTF::notFound);
+    m_variableSetterElements.append(element);
+}
+
+void WMLTaskElement::deregisterVariableSetter(WMLSetvarElement* element)
+{
+    size_t position = m_variableSetterElements.find(element);
+    ASSERT(position != WTF::notFound);
+    m_variableSetterElements.remove(position);
 }
 
 void WMLTaskElement::storeVariableState(WMLPageState* pageState)
@@ -73,19 +93,23 @@ void WMLTaskElement::storeVariableState(WMLPageState* pageState)
         return;
 
     WMLVariableMap variables;
-    HashSet<WMLSetvarElement*>::iterator it = m_variableSetterElements.begin();
-    HashSet<WMLSetvarElement*>::iterator end = m_variableSetterElements.end();
+    Vector<WMLSetvarElement*>::iterator it = m_variableSetterElements.begin();
+    Vector<WMLSetvarElement*>::iterator end = m_variableSetterElements.end();
 
     for (; it != end; ++it) {
         WMLSetvarElement* setterElement = (*it);
-        if (setterElement->name().isEmpty())
+
+        String name = setterElement->name();
+        if (name.isEmpty())
             continue;
 
-        variables.set(setterElement->name(), setterElement->value());
-    }
+        String value = setterElement->value();
+        variables.set(name, value);
 
-    if (variables.isEmpty())
-        return;
+        // The next setvar element may depend on this variable value. It's safe to store the current
+        // name value pair in the page state, as the whole page state is replaced soon by this new map
+        pageState->storeVariable(name, value);
+    }
 
     pageState->storeVariables(variables);
 }