Diff
Copied: branches/chromium/1229/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt (from rev 125162, trunk/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt) (0 => 127641)
--- branches/chromium/1229/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt (rev 0)
+++ branches/chromium/1229/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt 2012-09-05 20:43:05 UTC (rev 127641)
@@ -0,0 +1,11 @@
+Ensures that DOMCharacterDataModified isn't fired inside shadows.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS fired is false
+PASS div.innerHTML is 'Hello, World!'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/chromium/1229/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html (from rev 125162, trunk/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html) (0 => 127641)
--- branches/chromium/1229/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html (rev 0)
+++ branches/chromium/1229/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html 2012-09-05 20:43:05 UTC (rev 127641)
@@ -0,0 +1,25 @@
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<div id="host"></div>
+<script>
+description("Ensures that DOMCharacterDataModified isn't fired inside shadows.");
+var fired = false;
+var host = document.getElementById("host");
+var shadow = new WebKitShadowRoot(host);
+var div = document.createElement("div");
+div.addEventListener("DOMCharacterDataModified", function(evt) {
+ fired = true;
+}, false);
+
+shadow.appendChild(div);
+div.innerHTML = "Hello, ";
+div.firstChild.appendData("World!");
+shouldBeFalse("fired");
+shouldBe("div.innerHTML", "'Hello, World!'");
+</script>
+<script src=""
+</body>
+</html>
Modified: branches/chromium/1229/LayoutTests/fast/events/dom-character-data-modified-textarea-crash.html (127640 => 127641)
--- branches/chromium/1229/LayoutTests/fast/events/dom-character-data-modified-textarea-crash.html 2012-09-05 20:40:24 UTC (rev 127640)
+++ branches/chromium/1229/LayoutTests/fast/events/dom-character-data-modified-textarea-crash.html 2012-09-05 20:43:05 UTC (rev 127641)
@@ -5,17 +5,28 @@
// This test uses a weired textarea to reproduce the issue. The condition of a crash is very sensitive to HTML.
// If we add a new-line at EOF or add other tags in <body> part, the crash will be unlikely to happen.
// For example, if we move this comment to the actual HTML or try to load 'js-test-pre.js', the crash won't happen.
-// Mutation events should not be dispatched on this case. This bug is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372
-if (window.testRunner)
+//
+// * Mutation events should not be dispatched on this case. This bug is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372
+// * ... And Mutation events are no longer fired. See https://bugs.webkit.org/show_bug.cgi?id=93427.
+// We would keep this test just for preventing regression.
+if (window.testRunner) {
testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
-document.addEventListener("DOMCharacterDataModified", function() {
+function attackAndFinish() {
document.designMode = "on";
document.execCommand("SelectAll");
document.execCommand("Delete");
document.body.offsetLeft;
document.body.innerHTML = 'Test passes if a DOMCharacterModified event on the textarea does not crash.';
-});
+ if (window.testRunner)
+ testRunner.notifyDone();
+}
+
+document.addEventListener("DOMCharacterDataModified", attackAndFinish);
+
+window.setTimeout(attackAndFinish, 10);
</script>
</head>
-<textarea> <
\ No newline at end of file
+<textarea> <
Copied: branches/chromium/1229/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text-expected.txt (from rev 125162, trunk/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text-expected.txt) (0 => 127641)
--- branches/chromium/1229/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text-expected.txt (rev 0)
+++ branches/chromium/1229/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text-expected.txt 2012-09-05 20:43:05 UTC (rev 127641)
@@ -0,0 +1,10 @@
+Ensuring that mutation event with text modification on a textarea doesn't crash
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS unless crash.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/chromium/1229/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text.html (from rev 125162, trunk/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text.html) (0 => 127641)
--- branches/chromium/1229/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text.html (rev 0)
+++ branches/chromium/1229/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text.html 2012-09-05 20:43:05 UTC (rev 127641)
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script>
+description("Ensuring that mutation event with text modification on a textarea doesn't crash");
+
+span = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+document.implementation.createDocument("", "", null).adoptNode(span);
+
+textarea = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
+textarea.textContent = "Value";
+textarea.addEventListener("DOMCharacterDataModified", function (evt) { console.log(evt.target); textarea.textContent = ""; }, false);
+document.body.appendChild(textarea);
+
+text = document.createTextNode("Hello?");
+textarea.appendChild(text);
+span.appendChild(text);
+
+testPassed("unless crash.")
+</script>
+<script src=""
+</body>
Modified: branches/chromium/1229/LayoutTests/svg/custom/tref-nested-events-crash.svg (127640 => 127641)
--- branches/chromium/1229/LayoutTests/svg/custom/tref-nested-events-crash.svg 2012-09-05 20:40:24 UTC (rev 127640)
+++ branches/chromium/1229/LayoutTests/svg/custom/tref-nested-events-crash.svg 2012-09-05 20:43:05 UTC (rev 127641)
@@ -31,6 +31,8 @@
setTimeout('testRunner.notifyDone()', 0);
}, false);
document.adoptNode(tspan);
+ if (window.testRunner)
+ setTimeout('testRunner.notifyDone()', 10);
}
</script>
</svg>
Modified: branches/chromium/1229/Source/WebCore/dom/CharacterData.cpp (127640 => 127641)
--- branches/chromium/1229/Source/WebCore/dom/CharacterData.cpp 2012-09-05 20:40:24 UTC (rev 127640)
+++ branches/chromium/1229/Source/WebCore/dom/CharacterData.cpp 2012-09-05 20:43:05 UTC (rev 127641)
@@ -209,14 +209,16 @@
if (OwnPtr<MutationObserverInterestGroup> mutationRecipients = MutationObserverInterestGroup::createForCharacterDataMutation(this))
mutationRecipients->enqueueMutationRecord(MutationRecord::createCharacterData(this, oldData));
#endif
- if (parentNode())
- parentNode()->childrenChanged();
- if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER))
- dispatchScopedEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, 0, oldData, m_data));
- dispatchSubtreeModifiedEvent();
+ if (!isInShadowTree()) {
+ if (parentNode())
+ parentNode()->childrenChanged();
+ if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER))
+ dispatchScopedEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, 0, oldData, m_data));
+ dispatchSubtreeModifiedEvent();
#if ENABLE(INSPECTOR)
- InspectorInstrumentation::characterDataModified(document(), this);
+ InspectorInstrumentation::characterDataModified(document(), this);
#endif
+ }
}
void CharacterData::checkCharDataOperation(unsigned offset, ExceptionCode& ec)
