Diff
Modified: branches/safari-602-branch/LayoutTests/ChangeLog (209210 => 209211)
--- branches/safari-602-branch/LayoutTests/ChangeLog 2016-12-01 22:23:59 UTC (rev 209210)
+++ branches/safari-602-branch/LayoutTests/ChangeLog 2016-12-01 22:24:07 UTC (rev 209211)
@@ -1,5 +1,30 @@
2016-12-01 Matthew Hanson <matthew_han...@apple.com>
+ Merge r209145. rdar://problem/29404231
+
+ 2016-11-30 Brent Fulgham <bfulg...@apple.com>
+
+ Use 'childOfType' template when retrieving Shadow DOM elements
+ https://bugs.webkit.org/show_bug.cgi?id=165145
+ <rdar://problem/29331830>
+
+ Reviewed by Antti Koivisto.
+
+ * fast/shadow-dom/color-input-element-shadow-manipulation-expected.txt: Added.
+ * fast/shadow-dom/color-input-element-shadow-manipulation.html: Added.
+ * fast/shadow-dom/file-input-element-shadow-manipulation-expected.txt: Added.
+ * fast/shadow-dom/file-input-element-shadow-manipulation.html: Added.
+ * fast/shadow-dom/keygen-shadow-manipulation-expected.txt: Added.
+ * fast/shadow-dom/keygen-shadow-manipulation.html: Added.
+ * fast/shadow-dom/media-shadow-manipulation-expected.txt: Added.
+ * fast/shadow-dom/media-shadow-manipulation.html: Added.
+ * fast/shadow-dom/range-input-element-shadow-manipulation-expected.txt: Added.
+ * fast/shadow-dom/range-input-element-shadow-manipulation.html: Added.
+ * fast/shadow-dom/textarea-shadow-manipulation-expected.txt: Added.
+ * fast/shadow-dom/textarea-shadow-manipulation.html: Added.
+
+2016-12-01 Matthew Hanson <matthew_han...@apple.com>
+
Merge r208745. rdar://problem/29277336
2016-11-14 Brent Fulgham <bfulg...@apple.com>
Added: branches/safari-602-branch/LayoutTests/fast/shadow-dom/color-input-element-shadow-manipulation-expected.txt (0 => 209211)
--- branches/safari-602-branch/LayoutTests/fast/shadow-dom/color-input-element-shadow-manipulation-expected.txt (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/shadow-dom/color-input-element-shadow-manipulation-expected.txt 2016-12-01 22:24:07 UTC (rev 209211)
@@ -0,0 +1,5 @@
+PASS Passes if we did not debug assert.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+foo
Added: branches/safari-602-branch/LayoutTests/fast/shadow-dom/color-input-element-shadow-manipulation.html (0 => 209211)
--- branches/safari-602-branch/LayoutTests/fast/shadow-dom/color-input-element-shadow-manipulation.html (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/shadow-dom/color-input-element-shadow-manipulation.html 2016-12-01 22:24:07 UTC (rev 209211)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+function runTest() {
+ var bounds = color_input_element.getBoundingClientRect();
+ var range = document.caretRangeFromPoint(bounds.left + 10, bounds.top + 10);
+ var shadow_tree_container = range.commonAncestorContainer;
+ shadow_tree_container.prepend("foo");
+ color_input_element.disabled = true;
+ testPassed("Passes if we did not debug assert.");
+ finishJSTest();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+ <input type="color" id="color_input_element" style="position:absolute; height: 100px; width: 100px;">
+</body>
+</html>
Added: branches/safari-602-branch/LayoutTests/fast/shadow-dom/file-input-element-shadow-manipulation-expected.txt (0 => 209211)
--- branches/safari-602-branch/LayoutTests/fast/shadow-dom/file-input-element-shadow-manipulation-expected.txt (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/shadow-dom/file-input-element-shadow-manipulation-expected.txt 2016-12-01 22:24:07 UTC (rev 209211)
@@ -0,0 +1,5 @@
+PASS Passes if we did not debug assert.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+foo
Added: branches/safari-602-branch/LayoutTests/fast/shadow-dom/file-input-element-shadow-manipulation.html (0 => 209211)
--- branches/safari-602-branch/LayoutTests/fast/shadow-dom/file-input-element-shadow-manipulation.html (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/shadow-dom/file-input-element-shadow-manipulation.html 2016-12-01 22:24:07 UTC (rev 209211)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+function runTest() {
+ var bounds = file_input_element.getBoundingClientRect();
+ var range = document.caretRangeFromPoint(bounds.left + 10, bounds.top + 10);
+ var shadow_tree_container = range.commonAncestorContainer;
+ shadow_tree_container.prepend("foo");
+ file_input_element.disabled = true;
+ testPassed("Passes if we did not debug assert.");
+ finishJSTest();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+ <input type="file" id="file_input_element" style="position:absolute; height: 100px; width: 100px;">
+</body>
+</html>
Added: branches/safari-602-branch/LayoutTests/fast/shadow-dom/keygen-shadow-manipulation-expected.txt (0 => 209211)
--- branches/safari-602-branch/LayoutTests/fast/shadow-dom/keygen-shadow-manipulation-expected.txt (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/shadow-dom/keygen-shadow-manipulation-expected.txt 2016-12-01 22:24:07 UTC (rev 209211)
@@ -0,0 +1,5 @@
+PASS Passes if we did not debug assert.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: branches/safari-602-branch/LayoutTests/fast/shadow-dom/keygen-shadow-manipulation.html (0 => 209211)
--- branches/safari-602-branch/LayoutTests/fast/shadow-dom/keygen-shadow-manipulation.html (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/shadow-dom/keygen-shadow-manipulation.html 2016-12-01 22:24:07 UTC (rev 209211)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+function runTest() {
+ var bounds = keygen_element.getBoundingClientRect();
+ var range = document.caretRangeFromPoint(bounds.left + bounds.width / 2, bounds.top + bounds.height / 2);
+ var shadow_tree_container = range.commonAncestorContainer;
+ shadow_tree_container.prepend("foo");
+ keygen_element.disabled = true;
+ testPassed("Passes if we did not debug assert.");
+ finishJSTest();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+ <keygen id="keygen_element" style="position:absolute; height: 100px; width: 100px;">
+</body>
+</html>
Added: branches/safari-602-branch/LayoutTests/fast/shadow-dom/media-shadow-manipulation-expected.txt (0 => 209211)
--- branches/safari-602-branch/LayoutTests/fast/shadow-dom/media-shadow-manipulation-expected.txt (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/shadow-dom/media-shadow-manipulation-expected.txt 2016-12-01 22:24:07 UTC (rev 209211)
@@ -0,0 +1,5 @@
+PASS Passes if we did not debug assert.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+foo
Added: branches/safari-602-branch/LayoutTests/fast/shadow-dom/media-shadow-manipulation.html (0 => 209211)
--- branches/safari-602-branch/LayoutTests/fast/shadow-dom/media-shadow-manipulation.html (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/shadow-dom/media-shadow-manipulation.html 2016-12-01 22:24:07 UTC (rev 209211)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+function runTest() {
+ var bounds = video_element.getBoundingClientRect();
+ var range = document.caretRangeFromPoint(bounds.left + 10, bounds.bottom - 10);
+ var shadow_tree_container = range.commonAncestorContainer;
+ shadow_tree_container.prepend("foo");
+ video_element.disabled = true;
+ testPassed("Passes if we did not debug assert.");
+ finishJSTest();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+ <video id="video_element" style="position:absolute; height: 240px; width: 320px;" controls></video>
+</body>
+</html>
Added: branches/safari-602-branch/LayoutTests/fast/shadow-dom/range-input-element-shadow-manipulation-expected.txt (0 => 209211)
--- branches/safari-602-branch/LayoutTests/fast/shadow-dom/range-input-element-shadow-manipulation-expected.txt (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/shadow-dom/range-input-element-shadow-manipulation-expected.txt 2016-12-01 22:24:07 UTC (rev 209211)
@@ -0,0 +1,5 @@
+PASS Passes if we did not debug assert.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+foo
Added: branches/safari-602-branch/LayoutTests/fast/shadow-dom/range-input-element-shadow-manipulation.html (0 => 209211)
--- branches/safari-602-branch/LayoutTests/fast/shadow-dom/range-input-element-shadow-manipulation.html (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/shadow-dom/range-input-element-shadow-manipulation.html 2016-12-01 22:24:07 UTC (rev 209211)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+function runTest() {
+ var bounds = range_input_element.getBoundingClientRect();
+ var range = document.caretRangeFromPoint(bounds.left + bounds.width / 2, bounds.top + bounds.height / 2);
+ var shadow_tree_container = range.commonAncestorContainer;
+ shadow_tree_container.prepend("foo");
+ range_input_element.disabled = true;
+ testPassed("Passes if we did not debug assert.");
+ finishJSTest();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+ <input type="range" id="range_input_element" style="position:absolute; height: 30px; width: 100px;">
+</body>
+</html>
Added: branches/safari-602-branch/LayoutTests/fast/shadow-dom/textarea-shadow-manipulation-expected.txt (0 => 209211)
--- branches/safari-602-branch/LayoutTests/fast/shadow-dom/textarea-shadow-manipulation-expected.txt (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/shadow-dom/textarea-shadow-manipulation-expected.txt 2016-12-01 22:24:07 UTC (rev 209211)
@@ -0,0 +1,5 @@
+PASS Passes if we did not debug assert.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+foo
Added: branches/safari-602-branch/LayoutTests/fast/shadow-dom/textarea-shadow-manipulation.html (0 => 209211)
--- branches/safari-602-branch/LayoutTests/fast/shadow-dom/textarea-shadow-manipulation.html (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/shadow-dom/textarea-shadow-manipulation.html 2016-12-01 22:24:07 UTC (rev 209211)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+function runTest() {
+ var bounds = textarea_element.getBoundingClientRect();
+ var range = document.caretRangeFromPoint(bounds.left + bounds.width / 2, bounds.top + bounds.height / 2);
+ var shadow_tree_container = range.commonAncestorContainer;
+ shadow_tree_container.prepend("foo");
+ textarea_element.disabled = true;
+ testPassed("Passes if we did not debug assert.");
+ finishJSTest();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+ <textarea id="textarea_element" style="position:absolute; height: 100px; width: 100px;">Text Area</textarea>
+</body>
+</html>
Modified: branches/safari-602-branch/Source/WebCore/ChangeLog (209210 => 209211)
--- branches/safari-602-branch/Source/WebCore/ChangeLog 2016-12-01 22:23:59 UTC (rev 209210)
+++ branches/safari-602-branch/Source/WebCore/ChangeLog 2016-12-01 22:24:07 UTC (rev 209211)
@@ -1,5 +1,56 @@
2016-12-01 Matthew Hanson <matthew_han...@apple.com>
+ Merge r209145. rdar://problem/29404231
+
+ 2016-11-30 Brent Fulgham <bfulg...@apple.com>
+
+ Use 'childOfType' template when retrieving Shadow DOM elements
+ https://bugs.webkit.org/show_bug.cgi?id=165145
+ <rdar://problem/29331830>
+
+ Reviewed by Antti Koivisto.
+
+ Tests: fast/shadow-dom/color-input-element-shadow-manipulation.html
+ fast/shadow-dom/file-input-element-shadow-manipulation.html
+ fast/shadow-dom/keygen-shadow-manipulation.html
+ fast/shadow-dom/media-shadow-manipulation.html
+ fast/shadow-dom/range-input-element-shadow-manipulation.html
+ fast/shadow-dom/textarea-shadow-manipulation.html
+
+ Switch to using 'childOfType' when retrieving Shadow DOM elements, rather
+ than relying on expected element positions, as these can be changed by
+ _javascript_.
+
+ Drive by fix: Make more use of is<> and downcast<> templates rather than blindly casting.
+
+ * dom/Element.h:
+ (WebCore::Element::isUploadButton): Added.
+ (WebCore::Element::isSliderContainerElement): Added.
+ * html/ColorInputType.cpp:
+ (WebCore::ColorInputType::shadowColorSwatch): Use 'childOfType' rather than assuming
+ the first child is the one we want.
+ * html/FileInputType.cpp:
+ (isType): Added.
+ (WebCore::FileInputType::disabledAttributeChanged): Use 'childOfType' rather than assuming
+ the first child is the one we want.
+ (WebCore::FileInputType::multipleAttributeChanged): Ditto.
+ * html/HTMLKeygenElement.cpp:
+ (WebCore::HTMLKeygenElement::shadowSelect): Ditto.
+ * html/HTMLMediaElement.cpp:
+ (WebCore::HTMLMediaElement::mediaControls): Ditto.
+ (WebCore::HTMLMediaElement::hasMediaControls): Ditto.
+ * html/HTMLTextAreaElement.cpp:
+ (WebCore::HTMLTextAreaElement::innerTextElement): Ditto.
+ * html/RangeInputType.cpp:
+ (WebCore::RangeInputType::sliderTrackElement): Ditto.
+ * html/shadow/SliderThumbElement.h:
+ (isType): Added.
+ * svg/SVGUseElement.cpp:
+ (WebCore::SVGUseElement::targetClone): Use 'childOfType' rather than assuming
+ the first child is the one we want.
+
+2016-12-01 Matthew Hanson <matthew_han...@apple.com>
+
Merge r208745. rdar://problem/29277336
2016-11-14 Brent Fulgham <bfulg...@apple.com>
Modified: branches/safari-602-branch/Source/WebCore/dom/Element.h (209210 => 209211)
--- branches/safari-602-branch/Source/WebCore/dom/Element.h 2016-12-01 22:23:59 UTC (rev 209210)
+++ branches/safari-602-branch/Source/WebCore/dom/Element.h 2016-12-01 22:24:07 UTC (rev 209211)
@@ -422,6 +422,8 @@
virtual bool isInRange() const { return false; }
virtual bool isOutOfRange() const { return false; }
virtual bool isFrameElementBase() const { return false; }
+ virtual bool isUploadButton() const { return false; }
+ virtual bool isSliderContainerElement() const { return false; }
bool canContainRangeEndPoint() const override;
Modified: branches/safari-602-branch/Source/WebCore/html/ColorInputType.cpp (209210 => 209211)
--- branches/safari-602-branch/Source/WebCore/html/ColorInputType.cpp 2016-12-01 22:23:59 UTC (rev 209210)
+++ branches/safari-602-branch/Source/WebCore/html/ColorInputType.cpp 2016-12-01 22:24:07 UTC (rev 209211)
@@ -38,6 +38,7 @@
#include "CSSPropertyNames.h"
#include "Chrome.h"
#include "Color.h"
+#include "ElementChildIterator.h"
#include "HTMLDataListElement.h"
#include "HTMLDivElement.h"
#include "HTMLInputElement.h"
@@ -204,7 +205,14 @@
HTMLElement* ColorInputType::shadowColorSwatch() const
{
ShadowRoot* shadow = element().userAgentShadowRoot();
- return shadow ? downcast<HTMLElement>(shadow->firstChild()->firstChild()) : nullptr;
+ if (!shadow)
+ return nullptr;
+
+ auto wrapper = childrenOfType<HTMLDivElement>(*shadow).first();
+ if (!wrapper)
+ return nullptr;
+
+ return childrenOfType<HTMLDivElement>(*wrapper).first();
}
IntRect ColorInputType::elementRectRelativeToRootView() const
Modified: branches/safari-602-branch/Source/WebCore/html/FileInputType.cpp (209210 => 209211)
--- branches/safari-602-branch/Source/WebCore/html/FileInputType.cpp 2016-12-01 22:23:59 UTC (rev 209210)
+++ branches/safari-602-branch/Source/WebCore/html/FileInputType.cpp 2016-12-01 22:24:07 UTC (rev 209211)
@@ -24,6 +24,7 @@
#include "Chrome.h"
#include "DragData.h"
+#include "ElementChildIterator.h"
#include "Event.h"
#include "File.h"
#include "FileList.h"
@@ -39,10 +40,21 @@
#include "RenderFileUploadControl.h"
#include "ScriptController.h"
#include "ShadowRoot.h"
+#include <wtf/TypeCasts.h>
#include <wtf/text/StringBuilder.h>
+
namespace WebCore {
+class UploadButtonElement;
+}
+SPECIALIZE_TYPE_TRAITS_BEGIN(WebCore::UploadButtonElement)
+ static bool isType(const WebCore::Element& element) { return element.isUploadButton(); }
+ static bool isType(const WebCore::Node& node) { return is<WebCore::Element>(node) && isType(downcast<WebCore::Element>(node)); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+namespace WebCore {
+
using namespace HTMLNames;
class UploadButtonElement final : public HTMLInputElement {
@@ -51,6 +63,8 @@
static Ref<UploadButtonElement> createForMultiple(Document&);
private:
+ bool isUploadButton() const override { return true; }
+
UploadButtonElement(Document&);
};
@@ -277,8 +291,12 @@
void FileInputType::disabledAttributeChanged()
{
ASSERT(element().shadowRoot());
- UploadButtonElement* button = static_cast<UploadButtonElement*>(element().userAgentShadowRoot()->firstChild());
- if (button)
+
+ ShadowRoot* root = element().userAgentShadowRoot();
+ if (!root)
+ return;
+
+ if (auto* button = childrenOfType<UploadButtonElement>(*root).first())
button->setBooleanAttribute(disabledAttr, element().isDisabledFormControl());
}
@@ -285,8 +303,12 @@
void FileInputType::multipleAttributeChanged()
{
ASSERT(element().shadowRoot());
- UploadButtonElement* button = static_cast<UploadButtonElement*>(element().userAgentShadowRoot()->firstChild());
- if (button)
+
+ ShadowRoot* root = element().userAgentShadowRoot();
+ if (!root)
+ return;
+
+ if (auto* button = childrenOfType<UploadButtonElement>(*root).first())
button->setValue(element().multiple() ? fileButtonChooseMultipleFilesLabel() : fileButtonChooseFileLabel());
}
Modified: branches/safari-602-branch/Source/WebCore/html/HTMLKeygenElement.cpp (209210 => 209211)
--- branches/safari-602-branch/Source/WebCore/html/HTMLKeygenElement.cpp 2016-12-01 22:23:59 UTC (rev 209210)
+++ branches/safari-602-branch/Source/WebCore/html/HTMLKeygenElement.cpp 2016-12-01 22:24:07 UTC (rev 209211)
@@ -2,7 +2,7 @@
* Copyright (C) 1999 Lars Knoll (kn...@kde.org)
* (C) 1999 Antti Koivisto (koivi...@kde.org)
* (C) 2001 Dirk Mueller (muel...@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2004-2006, 2010, 2012-2016 Apple Inc. All rights reserved.
* (C) 2006 Alexey Proskuryakov (a...@nypop.com)
*
* This library is free software; you can redistribute it and/or
@@ -27,6 +27,7 @@
#include "Attribute.h"
#include "Document.h"
+#include "ElementChildIterator.h"
#include "FormDataList.h"
#include "HTMLNames.h"
#include "HTMLSelectElement.h"
@@ -145,7 +146,10 @@
HTMLSelectElement* HTMLKeygenElement::shadowSelect() const
{
ShadowRoot* root = userAgentShadowRoot();
- return root ? downcast<HTMLSelectElement>(root->firstChild()) : nullptr;
+ if (!root)
+ return nullptr;
+
+ return childrenOfType<HTMLSelectElement>(*root).first();
}
} // namespace
Modified: branches/safari-602-branch/Source/WebCore/html/HTMLMediaElement.cpp (209210 => 209211)
--- branches/safari-602-branch/Source/WebCore/html/HTMLMediaElement.cpp 2016-12-01 22:23:59 UTC (rev 209210)
+++ branches/safari-602-branch/Source/WebCore/html/HTMLMediaElement.cpp 2016-12-01 22:24:07 UTC (rev 209211)
@@ -5965,9 +5965,13 @@
MediaControls* HTMLMediaElement::mediaControls() const
{
#if ENABLE(MEDIA_CONTROLS_SCRIPT)
- return 0;
+ return nullptr;
#else
- return toMediaControls(userAgentShadowRoot()->firstChild());
+ ShadowRoot* root = userAgentShadowRoot();
+ if (!root)
+ return nullptr;
+
+ return childrenOfType<MediaControls>(*root).first();
#endif
}
@@ -5978,7 +5982,7 @@
#else
if (ShadowRoot* userAgent = userAgentShadowRoot()) {
- Node* node = userAgent->firstChild();
+ Node* node = childrenOfType<MediaControls>(*root).first();
ASSERT_WITH_SECURITY_IMPLICATION(!node || node->isMediaControls());
return node;
}
Modified: branches/safari-602-branch/Source/WebCore/html/HTMLTextAreaElement.cpp (209210 => 209211)
--- branches/safari-602-branch/Source/WebCore/html/HTMLTextAreaElement.cpp 2016-12-01 22:23:59 UTC (rev 209210)
+++ branches/safari-602-branch/Source/WebCore/html/HTMLTextAreaElement.cpp 2016-12-01 22:24:07 UTC (rev 209211)
@@ -2,7 +2,7 @@
* Copyright (C) 1999 Lars Knoll (kn...@kde.org)
* (C) 1999 Antti Koivisto (koivi...@kde.org)
* (C) 2001 Dirk Mueller (muel...@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2004-2008, 2010, 2014, 2016 Apple Inc. All rights reserved.
* (C) 2006 Alexey Proskuryakov (a...@nypop.com)
* Copyright (C) 2007 Samuel Weinig (s...@webkit.org)
*
@@ -30,6 +30,7 @@
#include "CSSValueKeywords.h"
#include "Document.h"
#include "Editor.h"
+#include "ElementChildIterator.h"
#include "Event.h"
#include "EventHandler.h"
#include "EventNames.h"
@@ -324,7 +325,11 @@
TextControlInnerTextElement* HTMLTextAreaElement::innerTextElement() const
{
- return downcast<TextControlInnerTextElement>(userAgentShadowRoot()->firstChild());
+ ShadowRoot* root = userAgentShadowRoot();
+ if (!root)
+ return nullptr;
+
+ return childrenOfType<TextControlInnerTextElement>(*root).first();
}
void HTMLTextAreaElement::rendererWillBeDestroyed()
Modified: branches/safari-602-branch/Source/WebCore/html/RangeInputType.cpp (209210 => 209211)
--- branches/safari-602-branch/Source/WebCore/html/RangeInputType.cpp 2016-12-01 22:23:59 UTC (rev 209210)
+++ branches/safari-602-branch/Source/WebCore/html/RangeInputType.cpp 2016-12-01 22:24:07 UTC (rev 209211)
@@ -33,6 +33,7 @@
#include "RangeInputType.h"
#include "AXObjectCache.h"
+#include "ElementChildIterator.h"
#include "EventNames.h"
#include "ExceptionCodePlaceholder.h"
#include "HTMLInputElement.h"
@@ -270,7 +271,15 @@
ASSERT(element().userAgentShadowRoot()->firstChild()->isHTMLElement());
ASSERT(element().userAgentShadowRoot()->firstChild()->firstChild()); // track
- return downcast<HTMLElement>(element().userAgentShadowRoot()->firstChild()->firstChild());
+ ShadowRoot* root = element().userAgentShadowRoot();
+ if (!root)
+ return nullptr;
+
+ auto* container = childrenOfType<SliderContainerElement>(*root).first();
+ if (!container)
+ return nullptr;
+
+ return childrenOfType<HTMLElement>(*container).first();
}
SliderThumbElement& RangeInputType::typedSliderThumbElement() const
Modified: branches/safari-602-branch/Source/WebCore/html/shadow/SliderThumbElement.h (209210 => 209211)
--- branches/safari-602-branch/Source/WebCore/html/shadow/SliderThumbElement.h 2016-12-01 22:23:59 UTC (rev 209210)
+++ branches/safari-602-branch/Source/WebCore/html/shadow/SliderThumbElement.h 2016-12-01 22:24:07 UTC (rev 209211)
@@ -137,10 +137,16 @@
RenderPtr<RenderElement> createElementRenderer(RenderStyle&&, const RenderTreePosition&) override;
Optional<ElementStyle> resolveCustomStyle(const RenderStyle&, const RenderStyle*) override;
const AtomicString& shadowPseudoId() const override;
+ bool isSliderContainerElement() const override { return true; }
AtomicString m_shadowPseudoId;
};
-}
+} // namespace WebCore
+SPECIALIZE_TYPE_TRAITS_BEGIN(WebCore::SliderContainerElement)
+ static bool isType(const WebCore::Element& element) { return element.isSliderContainerElement(); }
+ static bool isType(const WebCore::Node& node) { return is<WebCore::Element>(node) && isType(downcast<WebCore::Element>(node)); }
+SPECIALIZE_TYPE_TRAITS_END()
+
#endif
Modified: branches/safari-602-branch/Source/WebCore/svg/SVGUseElement.cpp (209210 => 209211)
--- branches/safari-602-branch/Source/WebCore/svg/SVGUseElement.cpp 2016-12-01 22:23:59 UTC (rev 209210)
+++ branches/safari-602-branch/Source/WebCore/svg/SVGUseElement.cpp 2016-12-01 22:24:07 UTC (rev 209211)
@@ -261,7 +261,7 @@
auto* root = userAgentShadowRoot();
if (!root)
return nullptr;
- return downcast<SVGElement>(root->firstChild());
+ return childrenOfType<SVGElement>(*root).first();
}
RenderPtr<RenderElement> SVGUseElement::createElementRenderer(RenderStyle&& style, const RenderTreePosition&)
