Title: [104441] trunk
- Revision
- 104441
- Author
- [email protected]
- Date
- 2012-01-09 00:53:36 -0800 (Mon, 09 Jan 2012)
Log Message
insertAdjacentHTML doesn't play nice with DocumentFragment
https://bugs.webkit.org/show_bug.cgi?id=75826
Reviewed by Eric Seidel.
Source/WebCore:
Test: fast/dom/insertAdjacentHTML-DocumentFragment-crash.html
Document nodes aren't the only non-Element ContainerNodes.
* html/HTMLElement.cpp:
(WebCore::contextElementForInsertion):
LayoutTests:
* fast/dom/insertAdjacentHTML-DocumentFragment-crash-expected.txt: Added.
* fast/dom/insertAdjacentHTML-DocumentFragment-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (104440 => 104441)
--- trunk/LayoutTests/ChangeLog 2012-01-09 08:42:44 UTC (rev 104440)
+++ trunk/LayoutTests/ChangeLog 2012-01-09 08:53:36 UTC (rev 104441)
@@ -1,3 +1,13 @@
+2012-01-09 Adam Barth <[email protected]>
+
+ insertAdjacentHTML doesn't play nice with DocumentFragment
+ https://bugs.webkit.org/show_bug.cgi?id=75826
+
+ Reviewed by Eric Seidel.
+
+ * fast/dom/insertAdjacentHTML-DocumentFragment-crash-expected.txt: Added.
+ * fast/dom/insertAdjacentHTML-DocumentFragment-crash.html: Added.
+
2012-01-09 Philippe Normand <[email protected]>
Unreviewed, GTK rebaseline after r104412.
Added: trunk/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash-expected.txt (0 => 104441)
--- trunk/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash-expected.txt 2012-01-09 08:53:36 UTC (rev 104441)
@@ -0,0 +1,2 @@
+CONSOLE MESSAGE: line 9: Uncaught Error: NO_MODIFICATION_ALLOWED_ERR: DOM Exception 7
+This test passes if it doesn't crash (or ASSERT).
Added: trunk/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash.html (0 => 104441)
--- trunk/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash.html (rev 0)
+++ trunk/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash.html 2012-01-09 08:53:36 UTC (rev 104441)
@@ -0,0 +1,10 @@
+This test passes if it doesn't crash (or ASSERT).
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+var f = document.createDocumentFragment();
+var s = document.createElement('div');
+f.appendChild(s);
+s.insertAdjacentHTML('afterend', "aaa");
+</script>
Modified: trunk/Source/WebCore/ChangeLog (104440 => 104441)
--- trunk/Source/WebCore/ChangeLog 2012-01-09 08:42:44 UTC (rev 104440)
+++ trunk/Source/WebCore/ChangeLog 2012-01-09 08:53:36 UTC (rev 104441)
@@ -1,3 +1,17 @@
+2012-01-09 Adam Barth <[email protected]>
+
+ insertAdjacentHTML doesn't play nice with DocumentFragment
+ https://bugs.webkit.org/show_bug.cgi?id=75826
+
+ Reviewed by Eric Seidel.
+
+ Test: fast/dom/insertAdjacentHTML-DocumentFragment-crash.html
+
+ Document nodes aren't the only non-Element ContainerNodes.
+
+ * html/HTMLElement.cpp:
+ (WebCore::contextElementForInsertion):
+
2012-01-09 Andreas Kling <[email protected]>
CSSStyleSelector: Any attribute with a decl() can be assumed to be mapped.
Modified: trunk/Source/WebCore/html/HTMLElement.cpp (104440 => 104441)
--- trunk/Source/WebCore/html/HTMLElement.cpp 2012-01-09 08:42:44 UTC (rev 104440)
+++ trunk/Source/WebCore/html/HTMLElement.cpp 2012-01-09 08:53:36 UTC (rev 104441)
@@ -642,7 +642,7 @@
{
if (equalIgnoringCase(where, "beforeBegin") || equalIgnoringCase(where, "afterEnd")) {
ContainerNode* parent = element->parentNode();
- if (parent && parent->isDocumentNode()) {
+ if (parent && !parent->isElementNode()) {
ec = NO_MODIFICATION_ALLOWED_ERR;
return 0;
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
