Title: [239877] trunk
- Revision
- 239877
- Author
- an...@apple.com
- Date
- 2019-01-11 14:38:24 -0800 (Fri, 11 Jan 2019)
Log Message
Release assert when removing element with a map element in the shadow tree
https://bugs.webkit.org/show_bug.cgi?id=193351
<rdar://problem/47208807>
Reviewed by Ryosuke Niwa.
Source/WebCore:
When a shadow host that has a map element in the shadow tree is removed from the document, we try
to remove the map from the scope of the host.
Test: fast/shadow-dom/image-map-tree-scope.html
* html/HTMLMapElement.cpp:
(WebCore::HTMLMapElement::insertedIntoAncestor):
(WebCore::HTMLMapElement::removedFromAncestor):
Add and remove image maps when the scope changes, not when the document changes.
This matches how id/name/etc updates work in the HTMLElement.
LayoutTests:
* fast/shadow-dom/image-map-tree-scope-expected.txt: Added.
* fast/shadow-dom/image-map-tree-scope.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (239876 => 239877)
--- trunk/LayoutTests/ChangeLog 2019-01-11 22:36:14 UTC (rev 239876)
+++ trunk/LayoutTests/ChangeLog 2019-01-11 22:38:24 UTC (rev 239877)
@@ -1,3 +1,14 @@
+2019-01-11 Antti Koivisto <an...@apple.com>
+
+ Release assert when removing element with a map element in the shadow tree
+ https://bugs.webkit.org/show_bug.cgi?id=193351
+ <rdar://problem/47208807>
+
+ Reviewed by Ryosuke Niwa.
+
+ * fast/shadow-dom/image-map-tree-scope-expected.txt: Added.
+ * fast/shadow-dom/image-map-tree-scope.html: Added.
+
2019-01-11 Dominik Infuehr <dinfu...@igalia.com>
Enable DFG on ARM/Linux again
Added: trunk/LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt (0 => 239877)
--- trunk/LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt 2019-01-11 22:38:24 UTC (rev 239877)
@@ -0,0 +1 @@
+This test passes if it doesn't crash.
Added: trunk/LayoutTests/fast/shadow-dom/image-map-tree-scope.html (0 => 239877)
--- trunk/LayoutTests/fast/shadow-dom/image-map-tree-scope.html (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/image-map-tree-scope.html 2019-01-11 22:38:24 UTC (rev 239877)
@@ -0,0 +1,19 @@
+<html>
+<head>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function test() {
+ var shadow = host.attachShadow({mode: "open"});
+ shadow.innerHTML = '<map name="bar">';
+ host.remove();
+}
+</script>
+</head>
+<body _onload_="test()">
+This test passes if it doesn't crash.
+<map id="map" name="foo"></map>
+<div id="host"></div>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (239876 => 239877)
--- trunk/Source/WebCore/ChangeLog 2019-01-11 22:36:14 UTC (rev 239876)
+++ trunk/Source/WebCore/ChangeLog 2019-01-11 22:38:24 UTC (rev 239877)
@@ -1,3 +1,23 @@
+2019-01-11 Antti Koivisto <an...@apple.com>
+
+ Release assert when removing element with a map element in the shadow tree
+ https://bugs.webkit.org/show_bug.cgi?id=193351
+ <rdar://problem/47208807>
+
+ Reviewed by Ryosuke Niwa.
+
+ When a shadow host that has a map element in the shadow tree is removed from the document, we try
+ to remove the map from the scope of the host.
+
+ Test: fast/shadow-dom/image-map-tree-scope.html
+
+ * html/HTMLMapElement.cpp:
+ (WebCore::HTMLMapElement::insertedIntoAncestor):
+ (WebCore::HTMLMapElement::removedFromAncestor):
+
+ Add and remove image maps when the scope changes, not when the document changes.
+ This matches how id/name/etc updates work in the HTMLElement.
+
2019-01-11 Sihui Liu <sihui_...@apple.com>
Fix an assertion in UniqueIDBDatabase
Modified: trunk/Source/WebCore/html/HTMLMapElement.cpp (239876 => 239877)
--- trunk/Source/WebCore/html/HTMLMapElement.cpp 2019-01-11 22:36:14 UTC (rev 239876)
+++ trunk/Source/WebCore/html/HTMLMapElement.cpp 2019-01-11 22:38:24 UTC (rev 239877)
@@ -118,7 +118,7 @@
Node::InsertedIntoAncestorResult HTMLMapElement::insertedIntoAncestor(InsertionType insertionType, ContainerNode& parentOfInsertedTree)
{
Node::InsertedIntoAncestorResult request = HTMLElement::insertedIntoAncestor(insertionType, parentOfInsertedTree);
- if (insertionType.connectedToDocument)
+ if (insertionType.treeScopeChanged)
treeScope().addImageMap(*this);
return request;
}
@@ -125,7 +125,7 @@
void HTMLMapElement::removedFromAncestor(RemovalType removalType, ContainerNode& oldParentOfRemovedTree)
{
- if (removalType.disconnectedFromDocument)
+ if (removalType.treeScopeChanged)
oldParentOfRemovedTree.treeScope().removeImageMap(*this);
HTMLElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
