Title: [240071] branches/safari-607-branch
- Revision
- 240071
- Author
- [email protected]
- Date
- 2019-01-16 15:27:42 -0800 (Wed, 16 Jan 2019)
Log Message
Cherry-pick r239877. rdar://problem/47260302
Release assert when removing element with a map element in the shadow tree
https://bugs.webkit.org/show_bug.cgi?id=193351
<rdar://problem/47208807>
Reviewed by Ryosuke Niwa.
Source/WebCore:
When a shadow host that has a map element in the shadow tree is removed from the document, we try
to remove the map from the scope of the host.
Test: fast/shadow-dom/image-map-tree-scope.html
* html/HTMLMapElement.cpp:
(WebCore::HTMLMapElement::insertedIntoAncestor):
(WebCore::HTMLMapElement::removedFromAncestor):
Add and remove image maps when the scope changes, not when the document changes.
This matches how id/name/etc updates work in the HTMLElement.
LayoutTests:
* fast/shadow-dom/image-map-tree-scope-expected.txt: Added.
* fast/shadow-dom/image-map-tree-scope.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239877 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-607-branch/LayoutTests/ChangeLog (240070 => 240071)
--- branches/safari-607-branch/LayoutTests/ChangeLog 2019-01-16 23:27:38 UTC (rev 240070)
+++ branches/safari-607-branch/LayoutTests/ChangeLog 2019-01-16 23:27:42 UTC (rev 240071)
@@ -1,5 +1,48 @@
2019-01-15 Alan Coon <[email protected]>
+ Cherry-pick r239877. rdar://problem/47260302
+
+ Release assert when removing element with a map element in the shadow tree
+ https://bugs.webkit.org/show_bug.cgi?id=193351
+ <rdar://problem/47208807>
+
+ Reviewed by Ryosuke Niwa.
+
+ Source/WebCore:
+
+ When a shadow host that has a map element in the shadow tree is removed from the document, we try
+ to remove the map from the scope of the host.
+
+ Test: fast/shadow-dom/image-map-tree-scope.html
+
+ * html/HTMLMapElement.cpp:
+ (WebCore::HTMLMapElement::insertedIntoAncestor):
+ (WebCore::HTMLMapElement::removedFromAncestor):
+
+ Add and remove image maps when the scope changes, not when the document changes.
+ This matches how id/name/etc updates work in the HTMLElement.
+
+ LayoutTests:
+
+ * fast/shadow-dom/image-map-tree-scope-expected.txt: Added.
+ * fast/shadow-dom/image-map-tree-scope.html: Added.
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239877 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-01-11 Antti Koivisto <[email protected]>
+
+ Release assert when removing element with a map element in the shadow tree
+ https://bugs.webkit.org/show_bug.cgi?id=193351
+ <rdar://problem/47208807>
+
+ Reviewed by Ryosuke Niwa.
+
+ * fast/shadow-dom/image-map-tree-scope-expected.txt: Added.
+ * fast/shadow-dom/image-map-tree-scope.html: Added.
+
+2019-01-15 Alan Coon <[email protected]>
+
Cherry-pick r239832. rdar://problem/47260343
Override the session configuration for cookieAcceptPolicy
Added: branches/safari-607-branch/LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt (0 => 240071)
--- branches/safari-607-branch/LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt 2019-01-16 23:27:42 UTC (rev 240071)
@@ -0,0 +1 @@
+This test passes if it doesn't crash.
Added: branches/safari-607-branch/LayoutTests/fast/shadow-dom/image-map-tree-scope.html (0 => 240071)
--- branches/safari-607-branch/LayoutTests/fast/shadow-dom/image-map-tree-scope.html (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/shadow-dom/image-map-tree-scope.html 2019-01-16 23:27:42 UTC (rev 240071)
@@ -0,0 +1,19 @@
+<html>
+<head>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function test() {
+ var shadow = host.attachShadow({mode: "open"});
+ shadow.innerHTML = '<map name="bar">';
+ host.remove();
+}
+</script>
+</head>
+<body _onload_="test()">
+This test passes if it doesn't crash.
+<map id="map" name="foo"></map>
+<div id="host"></div>
+</body>
+</html>
Modified: branches/safari-607-branch/Source/WebCore/ChangeLog (240070 => 240071)
--- branches/safari-607-branch/Source/WebCore/ChangeLog 2019-01-16 23:27:38 UTC (rev 240070)
+++ branches/safari-607-branch/Source/WebCore/ChangeLog 2019-01-16 23:27:42 UTC (rev 240071)
@@ -1,5 +1,57 @@
2019-01-15 Alan Coon <[email protected]>
+ Cherry-pick r239877. rdar://problem/47260302
+
+ Release assert when removing element with a map element in the shadow tree
+ https://bugs.webkit.org/show_bug.cgi?id=193351
+ <rdar://problem/47208807>
+
+ Reviewed by Ryosuke Niwa.
+
+ Source/WebCore:
+
+ When a shadow host that has a map element in the shadow tree is removed from the document, we try
+ to remove the map from the scope of the host.
+
+ Test: fast/shadow-dom/image-map-tree-scope.html
+
+ * html/HTMLMapElement.cpp:
+ (WebCore::HTMLMapElement::insertedIntoAncestor):
+ (WebCore::HTMLMapElement::removedFromAncestor):
+
+ Add and remove image maps when the scope changes, not when the document changes.
+ This matches how id/name/etc updates work in the HTMLElement.
+
+ LayoutTests:
+
+ * fast/shadow-dom/image-map-tree-scope-expected.txt: Added.
+ * fast/shadow-dom/image-map-tree-scope.html: Added.
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239877 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-01-11 Antti Koivisto <[email protected]>
+
+ Release assert when removing element with a map element in the shadow tree
+ https://bugs.webkit.org/show_bug.cgi?id=193351
+ <rdar://problem/47208807>
+
+ Reviewed by Ryosuke Niwa.
+
+ When a shadow host that has a map element in the shadow tree is removed from the document, we try
+ to remove the map from the scope of the host.
+
+ Test: fast/shadow-dom/image-map-tree-scope.html
+
+ * html/HTMLMapElement.cpp:
+ (WebCore::HTMLMapElement::insertedIntoAncestor):
+ (WebCore::HTMLMapElement::removedFromAncestor):
+
+ Add and remove image maps when the scope changes, not when the document changes.
+ This matches how id/name/etc updates work in the HTMLElement.
+
+2019-01-15 Alan Coon <[email protected]>
+
Cherry-pick r239865. rdar://problem/47260332
IndexedDB: leak IDBTransaction, TransactionOperation and IDBRequest in layout tests
Modified: branches/safari-607-branch/Source/WebCore/html/HTMLMapElement.cpp (240070 => 240071)
--- branches/safari-607-branch/Source/WebCore/html/HTMLMapElement.cpp 2019-01-16 23:27:38 UTC (rev 240070)
+++ branches/safari-607-branch/Source/WebCore/html/HTMLMapElement.cpp 2019-01-16 23:27:42 UTC (rev 240071)
@@ -118,7 +118,7 @@
Node::InsertedIntoAncestorResult HTMLMapElement::insertedIntoAncestor(InsertionType insertionType, ContainerNode& parentOfInsertedTree)
{
Node::InsertedIntoAncestorResult request = HTMLElement::insertedIntoAncestor(insertionType, parentOfInsertedTree);
- if (insertionType.connectedToDocument)
+ if (insertionType.treeScopeChanged)
treeScope().addImageMap(*this);
return request;
}
@@ -125,7 +125,7 @@
void HTMLMapElement::removedFromAncestor(RemovalType removalType, ContainerNode& oldParentOfRemovedTree)
{
- if (removalType.disconnectedFromDocument)
+ if (removalType.treeScopeChanged)
oldParentOfRemovedTree.treeScope().removeImageMap(*this);
HTMLElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
