Title: [231621] trunk
- Revision
- 231621
- Author
- [email protected]
- Date
- 2018-05-09 17:08:40 -0700 (Wed, 09 May 2018)
Log Message
Release assert in TreeScopeOrderedMap::remove via HTMLImageElement::removedFromAncestor
https://bugs.webkit.org/show_bug.cgi?id=185493
Reviewed by Brent Fulgham.
Source/WebCore:
Fixed the bug that HTMLImageElement::removedFromAncestor and HTMLMapElement::removedFromAncestor
were calling removeImageElementByUsemap on the document instead of the shadow tree from which it was removed.
Test: fast/images/imagemap-in-shadow-tree-removed.html
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::removedFromAncestor):
* html/HTMLMapElement.cpp:
(WebCore::HTMLMapElement::removedFromAncestor):
LayoutTests:
Added a regression test.
* fast/images/imagemap-in-shadow-tree-removed-expected.txt: Added.
* fast/images/imagemap-in-shadow-tree-removed.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (231620 => 231621)
--- trunk/LayoutTests/ChangeLog 2018-05-10 00:06:49 UTC (rev 231620)
+++ trunk/LayoutTests/ChangeLog 2018-05-10 00:08:40 UTC (rev 231621)
@@ -1,3 +1,15 @@
+2018-05-09 Ryosuke Niwa <[email protected]>
+
+ Release assert in TreeScopeOrderedMap::remove via HTMLImageElement::removedFromAncestor
+ https://bugs.webkit.org/show_bug.cgi?id=185493
+
+ Reviewed by Brent Fulgham.
+
+ Added a regression test.
+
+ * fast/images/imagemap-in-shadow-tree-removed-expected.txt: Added.
+ * fast/images/imagemap-in-shadow-tree-removed.html: Added.
+
2018-05-09 Joanmarie Diggs <[email protected]>
AX: Hidden nodes which are not directly referenced should not participate name/description from content
Added: trunk/LayoutTests/fast/images/imagemap-in-shadow-tree-removed-expected.txt (0 => 231621)
--- trunk/LayoutTests/fast/images/imagemap-in-shadow-tree-removed-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/images/imagemap-in-shadow-tree-removed-expected.txt 2018-05-10 00:08:40 UTC (rev 231621)
@@ -0,0 +1,4 @@
+This tests removing an image map area inside a shadow tree. WebKit should not hit any assertions.
+
+PASS
+
Added: trunk/LayoutTests/fast/images/imagemap-in-shadow-tree-removed.html (0 => 231621)
--- trunk/LayoutTests/fast/images/imagemap-in-shadow-tree-removed.html (rev 0)
+++ trunk/LayoutTests/fast/images/imagemap-in-shadow-tree-removed.html 2018-05-10 00:08:40 UTC (rev 231621)
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src=""
+<p>This tests removing an image map area inside a shadow tree. WebKit should not hit any assertions.</p>
+<div id="result"></div>
+<script>
+
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+const host = document.createElement('div');
+document.body.appendChild(host);
+
+const shadowRoot = host.attachShadow({mode: 'closed'});
+shadowRoot.innerHTML = `<div></div>`;
+
+const container = document.createElement('div');
+document.body.appendChild(container);
+container.innerHTML = `<img src="" width="400" height="400" usemap="" _onload_="startTest()">
+<map name="imagemap">
+ <area id="area" shape="rect" coords="0,0,200,200" href="" tabindex="0">
+</map>`;
+
+function startTest()
+{
+ shadowRoot.firstChild.appendChild(container);
+ container.remove();
+ document.getElementById('result').textContent = 'PASS';
+}
+
+</script>
+</body>
+</head>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (231620 => 231621)
--- trunk/Source/WebCore/ChangeLog 2018-05-10 00:06:49 UTC (rev 231620)
+++ trunk/Source/WebCore/ChangeLog 2018-05-10 00:08:40 UTC (rev 231621)
@@ -1,3 +1,20 @@
+2018-05-09 Ryosuke Niwa <[email protected]>
+
+ Release assert in TreeScopeOrderedMap::remove via HTMLImageElement::removedFromAncestor
+ https://bugs.webkit.org/show_bug.cgi?id=185493
+
+ Reviewed by Brent Fulgham.
+
+ Fixed the bug that HTMLImageElement::removedFromAncestor and HTMLMapElement::removedFromAncestor
+ were calling removeImageElementByUsemap on the document instead of the shadow tree from which it was removed.
+
+ Test: fast/images/imagemap-in-shadow-tree-removed.html
+
+ * html/HTMLImageElement.cpp:
+ (WebCore::HTMLImageElement::removedFromAncestor):
+ * html/HTMLMapElement.cpp:
+ (WebCore::HTMLMapElement::removedFromAncestor):
+
2018-05-09 Joanmarie Diggs <[email protected]>
AX: Hidden nodes which are not directly referenced should not participate name/description from content
Modified: trunk/Source/WebCore/html/HTMLImageElement.cpp (231620 => 231621)
--- trunk/Source/WebCore/html/HTMLImageElement.cpp 2018-05-10 00:06:49 UTC (rev 231620)
+++ trunk/Source/WebCore/html/HTMLImageElement.cpp 2018-05-10 00:08:40 UTC (rev 231621)
@@ -342,7 +342,7 @@
m_form->removeImgElement(this);
if (removalType.disconnectedFromDocument && !m_parsedUsemap.isNull())
- treeScope().removeImageElementByUsemap(*m_parsedUsemap.impl(), *this);
+ oldParentOfRemovedTree.treeScope().removeImageElementByUsemap(*m_parsedUsemap.impl(), *this);
if (is<HTMLPictureElement>(parentNode()))
setPictureElement(nullptr);
Modified: trunk/Source/WebCore/html/HTMLMapElement.cpp (231620 => 231621)
--- trunk/Source/WebCore/html/HTMLMapElement.cpp 2018-05-10 00:06:49 UTC (rev 231620)
+++ trunk/Source/WebCore/html/HTMLMapElement.cpp 2018-05-10 00:08:40 UTC (rev 231621)
@@ -126,7 +126,7 @@
void HTMLMapElement::removedFromAncestor(RemovalType removalType, ContainerNode& oldParentOfRemovedTree)
{
if (removalType.disconnectedFromDocument)
- treeScope().removeImageMap(*this);
+ oldParentOfRemovedTree.treeScope().removeImageMap(*this);
HTMLElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
