Title: [240409] branches/safari-607-branch
- Revision
- 240409
- Author
- [email protected]
- Date
- 2019-01-23 22:41:46 -0800 (Wed, 23 Jan 2019)
Log Message
Cherry-pick r239905. rdar://problem/47494732
Release assert with <img usemap> in shadow tree
https://bugs.webkit.org/show_bug.cgi?id=193378
Reviewed by Ryosuke Niwa.
Source/WebCore:
When a shadow host that has <img usemap> in the shadow tree is removed from the document, we try
to remove the map from the scope of the host.
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::parseAttribute):
(WebCore::HTMLImageElement::insertedIntoAncestor):
(WebCore::HTMLImageElement::removedFromAncestor):
Tree scope changes are relevant, not the connection to the document.
LayoutTests:
* fast/shadow-dom/image-map-tree-scope.html:
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239905 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-607-branch/LayoutTests/ChangeLog (240408 => 240409)
--- branches/safari-607-branch/LayoutTests/ChangeLog 2019-01-24 06:41:41 UTC (rev 240408)
+++ branches/safari-607-branch/LayoutTests/ChangeLog 2019-01-24 06:41:46 UTC (rev 240409)
@@ -1,5 +1,42 @@
2019-01-23 Alan Coon <[email protected]>
+ Cherry-pick r239905. rdar://problem/47494732
+
+ Release assert with <img usemap> in shadow tree
+ https://bugs.webkit.org/show_bug.cgi?id=193378
+
+ Reviewed by Ryosuke Niwa.
+
+ Source/WebCore:
+
+ When a shadow host that has <img usemap> in the shadow tree is removed from the document, we try
+ to remove the map from the scope of the host.
+
+ * html/HTMLImageElement.cpp:
+ (WebCore::HTMLImageElement::parseAttribute):
+ (WebCore::HTMLImageElement::insertedIntoAncestor):
+ (WebCore::HTMLImageElement::removedFromAncestor):
+
+ Tree scope changes are relevant, not the connection to the document.
+
+ LayoutTests:
+
+ * fast/shadow-dom/image-map-tree-scope.html:
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239905 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-01-13 Antti Koivisto <[email protected]>
+
+ Release assert with <img usemap> in shadow tree
+ https://bugs.webkit.org/show_bug.cgi?id=193378
+
+ Reviewed by Ryosuke Niwa.
+
+ * fast/shadow-dom/image-map-tree-scope.html:
+
+2019-01-23 Alan Coon <[email protected]>
+
Cherry-pick r240158. rdar://problem/47458281
FetchResponse::url should return the empty string for tainted responses
Modified: branches/safari-607-branch/LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt (240408 => 240409)
--- branches/safari-607-branch/LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt 2019-01-24 06:41:41 UTC (rev 240408)
+++ branches/safari-607-branch/LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt 2019-01-24 06:41:46 UTC (rev 240409)
@@ -1 +1 @@
-This test passes if it doesn't crash.
+This test passes if it doesn't crash.
Modified: branches/safari-607-branch/LayoutTests/fast/shadow-dom/image-map-tree-scope.html (240408 => 240409)
--- branches/safari-607-branch/LayoutTests/fast/shadow-dom/image-map-tree-scope.html 2019-01-24 06:41:41 UTC (rev 240408)
+++ branches/safari-607-branch/LayoutTests/fast/shadow-dom/image-map-tree-scope.html 2019-01-24 06:41:46 UTC (rev 240409)
@@ -6,7 +6,7 @@
function test() {
var shadow = host.attachShadow({mode: "open"});
- shadow.innerHTML = '<map name="bar">';
+ shadow.innerHTML = '<map name="bar"></map><img usemap=""
host.remove();
}
</script>
@@ -14,6 +14,7 @@
<body _onload_="test()">
This test passes if it doesn't crash.
<map id="map" name="foo"></map>
+<img usemap=""
<div id="host"></div>
</body>
</html>
Modified: branches/safari-607-branch/Source/WebCore/ChangeLog (240408 => 240409)
--- branches/safari-607-branch/Source/WebCore/ChangeLog 2019-01-24 06:41:41 UTC (rev 240408)
+++ branches/safari-607-branch/Source/WebCore/ChangeLog 2019-01-24 06:41:46 UTC (rev 240409)
@@ -1,3 +1,48 @@
+2019-01-23 Alan Coon <[email protected]>
+
+ Cherry-pick r239905. rdar://problem/47494732
+
+ Release assert with <img usemap> in shadow tree
+ https://bugs.webkit.org/show_bug.cgi?id=193378
+
+ Reviewed by Ryosuke Niwa.
+
+ Source/WebCore:
+
+ When a shadow host that has <img usemap> in the shadow tree is removed from the document, we try
+ to remove the map from the scope of the host.
+
+ * html/HTMLImageElement.cpp:
+ (WebCore::HTMLImageElement::parseAttribute):
+ (WebCore::HTMLImageElement::insertedIntoAncestor):
+ (WebCore::HTMLImageElement::removedFromAncestor):
+
+ Tree scope changes are relevant, not the connection to the document.
+
+ LayoutTests:
+
+ * fast/shadow-dom/image-map-tree-scope.html:
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239905 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-01-13 Antti Koivisto <[email protected]>
+
+ Release assert with <img usemap> in shadow tree
+ https://bugs.webkit.org/show_bug.cgi?id=193378
+
+ Reviewed by Ryosuke Niwa.
+
+ When a shadow host that has <img usemap> in the shadow tree is removed from the document, we try
+ to remove the map from the scope of the host.
+
+ * html/HTMLImageElement.cpp:
+ (WebCore::HTMLImageElement::parseAttribute):
+ (WebCore::HTMLImageElement::insertedIntoAncestor):
+ (WebCore::HTMLImageElement::removedFromAncestor):
+
+ Tree scope changes are relevant, not the connection to the document.
+
2019-01-23 Kocsen Chung <[email protected]>
Revert r238815. rdar://problem/47457960
Modified: branches/safari-607-branch/Source/WebCore/html/HTMLImageElement.cpp (240408 => 240409)
--- branches/safari-607-branch/Source/WebCore/html/HTMLImageElement.cpp 2019-01-24 06:41:41 UTC (rev 240408)
+++ branches/safari-607-branch/Source/WebCore/html/HTMLImageElement.cpp 2019-01-24 06:41:46 UTC (rev 240409)
@@ -225,12 +225,12 @@
} else if (name == srcAttr || name == srcsetAttr || name == sizesAttr)
selectImageSource();
else if (name == usemapAttr) {
- if (isConnected() && !m_parsedUsemap.isNull())
+ if (isInTreeScope() && !m_parsedUsemap.isNull())
treeScope().removeImageElementByUsemap(*m_parsedUsemap.impl(), *this);
m_parsedUsemap = parseHTMLHashNameReference(value);
- if (isConnected() && !m_parsedUsemap.isNull())
+ if (isInTreeScope() && !m_parsedUsemap.isNull())
treeScope().addImageElementByUsemap(*m_parsedUsemap.impl(), *this);
} else if (name == compositeAttr) {
// FIXME: images don't support blend modes in their compositing attribute.
@@ -354,7 +354,7 @@
if (insertionType.connectedToDocument && hasEditableImageAttribute())
insertNotificationRequest = InsertedIntoAncestorResult::NeedsPostInsertionCallback;
- if (insertionType.connectedToDocument && !m_parsedUsemap.isNull())
+ if (insertionType.treeScopeChanged && !m_parsedUsemap.isNull())
treeScope().addImageElementByUsemap(*m_parsedUsemap.impl(), *this);
if (is<HTMLPictureElement>(parentNode())) {
@@ -381,7 +381,7 @@
if (m_form)
m_form->removeImgElement(this);
- if (removalType.disconnectedFromDocument && !m_parsedUsemap.isNull())
+ if (removalType.treeScopeChanged && !m_parsedUsemap.isNull())
oldParentOfRemovedTree.treeScope().removeImageElementByUsemap(*m_parsedUsemap.impl(), *this);
if (is<HTMLPictureElement>(parentNode()))
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
