Diff
Modified: trunk/LayoutTests/ChangeLog (108417 => 108418)
--- trunk/LayoutTests/ChangeLog 2012-02-22 00:42:37 UTC (rev 108417)
+++ trunk/LayoutTests/ChangeLog 2012-02-22 00:46:38 UTC (rev 108418)
@@ -1,3 +1,17 @@
+2012-02-21 Adam Klein <[email protected]>
+
+ Setting innerText causes DOMSubtreeModified to be dispatched too early
+ https://bugs.webkit.org/show_bug.cgi?id=79140
+
+ Reviewed by Ryosuke Niwa.
+
+ * fast/dom/getElementById-consistency3-expected.txt: Added.
+ * fast/dom/getElementById-consistency3.html: Added.
+ * fast/dom/getElementById-consistency4-expected.txt: Added.
+ * fast/dom/getElementById-consistency4.html: Added.
+ * fast/dom/getElementById-consistency5-expected.txt: Added.
+ * fast/dom/getElementById-consistency5.html: Added.
+
2012-02-15 Ryosuke Niwa <[email protected]>
Assertion failure in TextIterator::handleTextBox
Added: trunk/LayoutTests/fast/dom/getElementById-consistency3-expected.txt (0 => 108418)
--- trunk/LayoutTests/fast/dom/getElementById-consistency3-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/getElementById-consistency3-expected.txt 2012-02-22 00:46:38 UTC (rev 108418)
@@ -0,0 +1,11 @@
+Test that DOMSubtreeModified listeners cannot cause DocumentOrderedMap to be incorrect
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS document.contains(el) is true
+PASS document.getElementById('el') is null
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Property changes on: trunk/LayoutTests/fast/dom/getElementById-consistency3-expected.txt
___________________________________________________________________
Added: svn:eol-style
Added: trunk/LayoutTests/fast/dom/getElementById-consistency3.html (0 => 108418)
--- trunk/LayoutTests/fast/dom/getElementById-consistency3.html (rev 0)
+++ trunk/LayoutTests/fast/dom/getElementById-consistency3.html 2012-02-22 00:46:38 UTC (rev 108418)
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<script src=""
+<div id=container>
+ <span id=el>
+ </span>
+</div>
+<script>
+description('Test that DOMSubtreeModified listeners cannot cause DocumentOrderedMap to be incorrect');
+
+var counter = 0;
+var container = document.getElementById('container');
+var el = document.getElementById('el');
+function broken() {
+ if (++counter > 2) {
+ document.removeEventListener('DOMSubtreeModified', broken, true);
+ return;
+ } else if (counter == 1)
+ container.innerText = '';
+ else
+ container.appendChild(el);
+}
+
+document.addEventListener("DOMSubtreeModified", broken, true);
+broken();
+shouldBeTrue("document.contains(el)");
+el.parentNode.removeChild(el);
+el = null;
+gc();
+shouldBeNull("document.getElementById('el')");
+</script>
+<script src=""
Property changes on: trunk/LayoutTests/fast/dom/getElementById-consistency3.html
___________________________________________________________________
Added: svn:eol-style
Added: trunk/LayoutTests/fast/dom/getElementById-consistency4-expected.txt (0 => 108418)
--- trunk/LayoutTests/fast/dom/getElementById-consistency4-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/getElementById-consistency4-expected.txt 2012-02-22 00:46:38 UTC (rev 108418)
@@ -0,0 +1,11 @@
+Test that DOMSubtreeModified listeners cannot cause DocumentOrderedMap to be incorrect
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS document.contains(el) is true
+PASS document.getElementById('el') is null
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Property changes on: trunk/LayoutTests/fast/dom/getElementById-consistency4-expected.txt
___________________________________________________________________
Added: svn:eol-style
Added: trunk/LayoutTests/fast/dom/getElementById-consistency4.html (0 => 108418)
--- trunk/LayoutTests/fast/dom/getElementById-consistency4.html (rev 0)
+++ trunk/LayoutTests/fast/dom/getElementById-consistency4.html 2012-02-22 00:46:38 UTC (rev 108418)
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<script src=""
+<div id=container>
+ <span id=el>
+ </span>
+</div>
+<script>
+description('Test that DOMSubtreeModified listeners cannot cause DocumentOrderedMap to be incorrect');
+
+var counter = 0;
+var container = document.getElementById('container');
+var el = document.getElementById('el');
+function broken() {
+ if (++counter > 2) {
+ document.removeEventListener('DOMSubtreeModified', broken, true);
+ return;
+ } else if (counter == 1)
+ container.innerHTML = '';
+ else
+ container.appendChild(el);
+}
+
+document.addEventListener("DOMSubtreeModified", broken, true);
+broken();
+shouldBeTrue("document.contains(el)");
+el.parentNode.removeChild(el);
+el = null;
+gc();
+shouldBeNull("document.getElementById('el')");
+</script>
+<script src=""
Property changes on: trunk/LayoutTests/fast/dom/getElementById-consistency4.html
___________________________________________________________________
Added: svn:eol-style
Added: trunk/LayoutTests/fast/dom/getElementById-consistency5-expected.txt (0 => 108418)
--- trunk/LayoutTests/fast/dom/getElementById-consistency5-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/getElementById-consistency5-expected.txt 2012-02-22 00:46:38 UTC (rev 108418)
@@ -0,0 +1,11 @@
+Test that DOMSubtreeModified listeners cannot cause DocumentOrderedMap to be incorrect
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS document.contains(el) is true
+PASS document.getElementById('el') is null
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Property changes on: trunk/LayoutTests/fast/dom/getElementById-consistency5-expected.txt
___________________________________________________________________
Added: svn:eol-style
Added: trunk/LayoutTests/fast/dom/getElementById-consistency5.html (0 => 108418)
--- trunk/LayoutTests/fast/dom/getElementById-consistency5.html (rev 0)
+++ trunk/LayoutTests/fast/dom/getElementById-consistency5.html 2012-02-22 00:46:38 UTC (rev 108418)
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<script src=""
+<div id=container>
+ <span id=el>
+ </span>
+</div>
+<script>
+description('Test that DOMSubtreeModified listeners cannot cause DocumentOrderedMap to be incorrect');
+
+var counter = 0;
+var container = document.getElementById('container');
+var el = document.getElementById('el');
+function broken() {
+ if (++counter > 2) {
+ document.removeEventListener('DOMSubtreeModified', broken, true);
+ return;
+ } else if (counter == 1)
+ container.textContent = '';
+ else
+ container.appendChild(el);
+}
+
+document.addEventListener("DOMSubtreeModified", broken, true);
+broken();
+shouldBeTrue("document.contains(el)");
+el.parentNode.removeChild(el);
+el = null;
+gc();
+shouldBeNull("document.getElementById('el')");
+</script>
+<script src=""
Property changes on: trunk/LayoutTests/fast/dom/getElementById-consistency5.html
___________________________________________________________________
Added: svn:eol-style
Modified: trunk/Source/WebCore/ChangeLog (108417 => 108418)
--- trunk/Source/WebCore/ChangeLog 2012-02-22 00:42:37 UTC (rev 108417)
+++ trunk/Source/WebCore/ChangeLog 2012-02-22 00:46:38 UTC (rev 108418)
@@ -1,3 +1,21 @@
+2012-02-21 Adam Klein <[email protected]>
+
+ Setting innerText causes DOMSubtreeModified to be dispatched too early
+ https://bugs.webkit.org/show_bug.cgi?id=79140
+
+ Reviewed by Ryosuke Niwa.
+
+ Followup to r108152: move children change notifications later in
+ ContainerNode::removeChildren(), thus making sure Node::inDocument()
+ is in the correct state when we call into script.
+
+ Tests: fast/dom/getElementById-consistency3.html
+ fast/dom/getElementById-consistency4.html
+ fast/dom/getElementById-consistency5.html
+
+ * dom/ContainerNode.cpp:
+ (WebCore::ContainerNode::removeChildren):
+
2012-02-15 Ryosuke Niwa <[email protected]>
Assertion failure in TextIterator::handleTextBox
Modified: trunk/Source/WebCore/dom/ContainerNode.cpp (108417 => 108418)
--- trunk/Source/WebCore/dom/ContainerNode.cpp 2012-02-22 00:42:37 UTC (rev 108417)
+++ trunk/Source/WebCore/dom/ContainerNode.cpp 2012-02-22 00:46:38 UTC (rev 108418)
@@ -592,11 +592,7 @@
removedChild->detach();
}
- allowEventDispatch();
-
- // Dispatch a single post-removal mutation event denoting a modified subtree.
childrenChanged(false, 0, 0, -static_cast<int>(removedChildrenCount));
- dispatchSubtreeModifiedEvent();
for (i = 0; i < removedChildrenCount; ++i) {
Node* removedChild = removedChildren[i].get();
@@ -606,6 +602,10 @@
// document. There is no explanation for this discrepancy between removeChild()
// and its optimized version removeChildren().
}
+
+ allowEventDispatch();
+
+ dispatchSubtreeModifiedEvent();
}
bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
