Merge webkit.org at r58033 : Initial merge by git

Change-Id: If006c38561af287c50cd578d251629b51e4d8cd1

1 files changed, 7 insertions, 2 deletions

diff --git a/WebCore/html/HTMLTitleElement.cpp b/WebCore/html/HTMLTitleElement.cpp
index b9a8de7..81ecd10 100644
--- a/WebCore/html/HTMLTitleElement.cpp
+++ b/WebCore/html/HTMLTitleElement.cpp
@@ -84,10 +84,15 @@ void HTMLTitleElement::setText(const String &value)
     if (numChildren == 1 && firstChild()->isTextNode())
         static_cast<Text*>(firstChild())->setData(value, ec);
     else {  
+        // We make a copy here because entity of "value" argument can be Document::m_title,
+        // which goes empty during removeChildren() invocation below,
+        // which causes HTMLTitleElement::childrenChanged(), which ends up Document::setTitle().
+        String valueCopy(value);
+
         if (numChildren > 0)
             removeChildren();
-    
-        appendChild(document()->createTextNode(value.impl()), ec);
+
+        appendChild(document()->createTextNode(valueCopy.impl()), ec);
     }
 }