- Revision
- 125162
- Author
- morr...@google.com
- Date
- 2012-08-09 01:16:54 -0700 (Thu, 09 Aug 2012)
Log Message
DOMCharacterDataModified should not be fired inside shadows
https://bugs.webkit.org/show_bug.cgi?id=93427
Reviewed by Ryosuke Niwa.
Source/WebCore:
CharacterData::dispatchModifiedEvent() fires DOMCharacterDataModified event even if
the node is in shadow. But it shouldn't. Check dispatchChildInsertionEvents() and
dispatchChildRemovalEvents() to see how other MutationEvents are suppressed behind shadows.
This change follows the same path to suppress DOMCharacterDataModified.
Tests: fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html
fast/forms/textarea-and-mutation-events-appending-text.html
* dom/CharacterData.cpp:
(WebCore::CharacterData::dispatchModifiedEvent):
LayoutTests:
Added two tests. This also fixes existing test, which cover the wrong behavior.
* fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt: Added.
* fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html: Added.
* fast/events/dom-character-data-modified-textarea-crash.html:
- DOMCharacterDataModified shouldn't be fired in this case.
Fixed to allow test to terminate without the event.
Note that The event was fired by <textarea>, which is fixed by this change.
* fast/forms/textarea-and-mutation-events-appending-text-expected.txt: Added.
* fast/forms/textarea-and-mutation-events-appending-text.html: Added.
* svg/custom/tref-nested-events-crash.svg:
- DOMCharacterDataModified shouldn't be fired in this case.
Fixed to allow test to terminate without the event.
Note that The event was fired by SVGShadowText, which is just an implentation detail and
should not be exposed.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (125161 => 125162)
--- trunk/LayoutTests/ChangeLog 2012-08-09 08:09:23 UTC (rev 125161)
+++ trunk/LayoutTests/ChangeLog 2012-08-09 08:16:54 UTC (rev 125162)
@@ -1,3 +1,26 @@
+2012-08-09 MORITA Hajime <morr...@google.com>
+
+ DOMCharacterDataModified should not be fired inside shadows
+ https://bugs.webkit.org/show_bug.cgi?id=93427
+
+ Reviewed by Ryosuke Niwa.
+
+ Added two tests. This also fixes existing test, which cover the wrong behavior.
+
+ * fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt: Added.
+ * fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html: Added.
+ * fast/events/dom-character-data-modified-textarea-crash.html:
+ - DOMCharacterDataModified shouldn't be fired in this case.
+ Fixed to allow test to terminate without the event.
+ Note that The event was fired by <textarea>, which is fixed by this change.
+ * fast/forms/textarea-and-mutation-events-appending-text-expected.txt: Added.
+ * fast/forms/textarea-and-mutation-events-appending-text.html: Added.
+ * svg/custom/tref-nested-events-crash.svg:
+ - DOMCharacterDataModified shouldn't be fired in this case.
+ Fixed to allow test to terminate without the event.
+ Note that The event was fired by SVGShadowText, which is just an implentation detail and
+ should not be exposed.
+
2012-08-09 Takashi Toyoshima <toyos...@chromium.org>
Unreviewed, update TestExpectations for chromium gardening.
Added: trunk/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt (0 => 125162)
--- trunk/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt 2012-08-09 08:16:54 UTC (rev 125162)
@@ -0,0 +1,11 @@
+Ensures that DOMCharacterDataModified isn't fired inside shadows.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS fired is false
+PASS div.innerHTML is 'Hello, World!'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html (0 => 125162)
--- trunk/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html 2012-08-09 08:16:54 UTC (rev 125162)
@@ -0,0 +1,25 @@
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<div id="host"></div>
+<script>
+description("Ensures that DOMCharacterDataModified isn't fired inside shadows.");
+var fired = false;
+var host = document.getElementById("host");
+var shadow = new WebKitShadowRoot(host);
+var div = document.createElement("div");
+div.addEventListener("DOMCharacterDataModified", function(evt) {
+ fired = true;
+}, false);
+
+shadow.appendChild(div);
+div.innerHTML = "Hello, ";
+div.firstChild.appendData("World!");
+shouldBeFalse("fired");
+shouldBe("div.innerHTML", "'Hello, World!'");
+</script>
+<script src=""
+</body>
+</html>
Modified: trunk/LayoutTests/fast/events/dom-character-data-modified-textarea-crash.html (125161 => 125162)
--- trunk/LayoutTests/fast/events/dom-character-data-modified-textarea-crash.html 2012-08-09 08:09:23 UTC (rev 125161)
+++ trunk/LayoutTests/fast/events/dom-character-data-modified-textarea-crash.html 2012-08-09 08:16:54 UTC (rev 125162)
@@ -5,17 +5,28 @@
// This test uses a weired textarea to reproduce the issue. The condition of a crash is very sensitive to HTML.
// If we add a new-line at EOF or add other tags in <body> part, the crash will be unlikely to happen.
// For example, if we move this comment to the actual HTML or try to load 'js-test-pre.js', the crash won't happen.
-// Mutation events should not be dispatched on this case. This bug is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372
-if (window.testRunner)
+//
+// * Mutation events should not be dispatched on this case. This bug is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372
+// * ... And Mutation events are no longer fired. See https://bugs.webkit.org/show_bug.cgi?id=93427.
+// We would keep this test just for preventing regression.
+if (window.testRunner) {
testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
-document.addEventListener("DOMCharacterDataModified", function() {
+function attackAndFinish() {
document.designMode = "on";
document.execCommand("SelectAll");
document.execCommand("Delete");
document.body.offsetLeft;
document.body.innerHTML = 'Test passes if a DOMCharacterModified event on the textarea does not crash.';
-});
+ if (window.testRunner)
+ testRunner.notifyDone();
+}
+
+document.addEventListener("DOMCharacterDataModified", attackAndFinish);
+
+window.setTimeout(attackAndFinish, 10);
</script>
</head>
-<textarea> <
\ No newline at end of file
+<textarea> <
Added: trunk/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text-expected.txt (0 => 125162)
--- trunk/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text-expected.txt 2012-08-09 08:16:54 UTC (rev 125162)
@@ -0,0 +1,10 @@
+Ensuring that mutation event with text modification on a textarea doesn't crash
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS unless crash.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text.html (0 => 125162)
--- trunk/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text.html (rev 0)
+++ trunk/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text.html 2012-08-09 08:16:54 UTC (rev 125162)
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script>
+description("Ensuring that mutation event with text modification on a textarea doesn't crash");
+
+span = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+document.implementation.createDocument("", "", null).adoptNode(span);
+
+textarea = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
+textarea.textContent = "Value";
+textarea.addEventListener("DOMCharacterDataModified", function (evt) { console.log(evt.target); textarea.textContent = ""; }, false);
+document.body.appendChild(textarea);
+
+text = document.createTextNode("Hello?");
+textarea.appendChild(text);
+span.appendChild(text);
+
+testPassed("unless crash.")
+</script>
+<script src=""
+</body>
Modified: trunk/LayoutTests/svg/custom/tref-nested-events-crash.svg (125161 => 125162)
--- trunk/LayoutTests/svg/custom/tref-nested-events-crash.svg 2012-08-09 08:09:23 UTC (rev 125161)
+++ trunk/LayoutTests/svg/custom/tref-nested-events-crash.svg 2012-08-09 08:16:54 UTC (rev 125162)
@@ -31,6 +31,8 @@
setTimeout('testRunner.notifyDone()', 0);
}, false);
document.adoptNode(tspan);
+ if (window.testRunner)
+ setTimeout('testRunner.notifyDone()', 10);
}
</script>
</svg>
Modified: trunk/Source/WebCore/ChangeLog (125161 => 125162)
--- trunk/Source/WebCore/ChangeLog 2012-08-09 08:09:23 UTC (rev 125161)
+++ trunk/Source/WebCore/ChangeLog 2012-08-09 08:16:54 UTC (rev 125162)
@@ -1,3 +1,21 @@
+2012-08-09 MORITA Hajime <morr...@google.com>
+
+ DOMCharacterDataModified should not be fired inside shadows
+ https://bugs.webkit.org/show_bug.cgi?id=93427
+
+ Reviewed by Ryosuke Niwa.
+
+ CharacterData::dispatchModifiedEvent() fires DOMCharacterDataModified event even if
+ the node is in shadow. But it shouldn't. Check dispatchChildInsertionEvents() and
+ dispatchChildRemovalEvents() to see how other MutationEvents are suppressed behind shadows.
+ This change follows the same path to suppress DOMCharacterDataModified.
+
+ Tests: fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html
+ fast/forms/textarea-and-mutation-events-appending-text.html
+
+ * dom/CharacterData.cpp:
+ (WebCore::CharacterData::dispatchModifiedEvent):
+
2012-08-09 Eric Seidel <e...@webkit.org>
Use m_everHadLayout in RenderObject::checkForRepaintDuringLayout()
Modified: trunk/Source/WebCore/dom/CharacterData.cpp (125161 => 125162)
--- trunk/Source/WebCore/dom/CharacterData.cpp 2012-08-09 08:09:23 UTC (rev 125161)
+++ trunk/Source/WebCore/dom/CharacterData.cpp 2012-08-09 08:16:54 UTC (rev 125162)
@@ -209,14 +209,16 @@
if (OwnPtr<MutationObserverInterestGroup> mutationRecipients = MutationObserverInterestGroup::createForCharacterDataMutation(this))
mutationRecipients->enqueueMutationRecord(MutationRecord::createCharacterData(this, oldData));
#endif
- if (parentNode())
- parentNode()->childrenChanged();
- if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER))
- dispatchScopedEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, 0, oldData, m_data));
- dispatchSubtreeModifiedEvent();
+ if (!isInShadowTree()) {
+ if (parentNode())
+ parentNode()->childrenChanged();
+ if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER))
+ dispatchScopedEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, 0, oldData, m_data));
+ dispatchSubtreeModifiedEvent();
#if ENABLE(INSPECTOR)
- InspectorInstrumentation::characterDataModified(document(), this);
+ InspectorInstrumentation::characterDataModified(document(), this);
#endif
+ }
}
void CharacterData::checkCharDataOperation(unsigned offset, ExceptionCode& ec)
