Title: [105342] branches/chromium/963
- Revision
- 105342
- Author
- infe...@chromium.org
- Date
- 2012-01-18 16:22:39 -0800 (Wed, 18 Jan 2012)
Log Message
Merge 104441 - insertAdjacentHTML doesn't play nice with DocumentFragment
BUG=109556
Review URL: https://chromiumcodereview.appspot.com/9250020
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash-expected.txt (from rev 104441, trunk/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash-expected.txt) (0 => 105342)
--- branches/chromium/963/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash-expected.txt 2012-01-19 00:22:39 UTC (rev 105342)
@@ -0,0 +1,2 @@
+CONSOLE MESSAGE: line 9: Uncaught Error: NO_MODIFICATION_ALLOWED_ERR: DOM Exception 7
+This test passes if it doesn't crash (or ASSERT).
Copied: branches/chromium/963/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash.html (from rev 104441, trunk/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash.html) (0 => 105342)
--- branches/chromium/963/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/dom/insertAdjacentHTML-DocumentFragment-crash.html 2012-01-19 00:22:39 UTC (rev 105342)
@@ -0,0 +1,10 @@
+This test passes if it doesn't crash (or ASSERT).
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+var f = document.createDocumentFragment();
+var s = document.createElement('div');
+f.appendChild(s);
+s.insertAdjacentHTML('afterend', "aaa");
+</script>
Modified: branches/chromium/963/Source/WebCore/html/HTMLElement.cpp (105341 => 105342)
--- branches/chromium/963/Source/WebCore/html/HTMLElement.cpp 2012-01-19 00:21:52 UTC (rev 105341)
+++ branches/chromium/963/Source/WebCore/html/HTMLElement.cpp 2012-01-19 00:22:39 UTC (rev 105342)
@@ -623,7 +623,7 @@
{
if (equalIgnoringCase(where, "beforeBegin") || equalIgnoringCase(where, "afterEnd")) {
ContainerNode* parent = element->parentNode();
- if (parent && parent->isDocumentNode()) {
+ if (parent && !parent->isElementNode()) {
ec = NO_MODIFICATION_ALLOWED_ERR;
return 0;
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
