Reviewers: ihab.awad,
Description:
This is a preliminary patch. I haven't figured out
how to add a testcase for this yet.
Cajoling this will fail to run on IE:
<div id=a>a1</div>a2
<script>1</script>
<div id=b>b1</div>b2
<script>2</script>
c1
The error from IE is "'detached[...]' is null or not an object".
The reason is that html-emitter assumes that when you
remove a node from the document, node.parentNode will
be null, but IE will sometimes create another detached
node to be the parent. In this case, one of the generated
<span> elements has a documentFragment parent.
This change fixes html-emitter so that when it searches
the detached nodes list, it makes sure it's comparing
the parentNode==null ancestor.
Please review this at http://codereview.appspot.com/89076
Affected files:
M src/com/google/caja/plugin/html-emitter.js
Index: src/com/google/caja/plugin/html-emitter.js
===================================================================
--- src/com/google/caja/plugin/html-emitter.js (revision 3549)
+++ src/com/google/caja/plugin/html-emitter.js (working copy)
@@ -181,10 +181,15 @@
// Reattach up to and including limit ancestor.
var nConsumed = 0;
while (true) {
- var toReattach = detached[nConsumed];
- (detached[nConsumed + 1] /* the parent */).appendChild(toReattach);
+ var reattach = detached[nConsumed];
+ // in IE, some types of nodes can't be standalone, and detaching
+ // one will create new parentNodes for them. so at this point,
+ // limitAnc might be an ancestor of the node on detached.
+ var reattAnc = reattach;
+ for (; reattAnc.parentNode; reattAnc = reattAnc.parentNode) {}
+ (detached[nConsumed + 1] /* the parent */).appendChild(reattach);
nConsumed += 2;
- if (toReattach === limitAnc) { break; }
+ if (reattAnc === limitAnc) { break; }
}
// Replace the reattached bits with the ones detached from limit.
newDetached[1] = nConsumed; // splice's second arg is the number
removed
