Title: [151821] trunk
- Revision
- 151821
- Author
- [email protected]
- Date
- 2013-06-20 20:50:47 -0700 (Thu, 20 Jun 2013)
Log Message
REGRESSION(r149652): accessing items in .children via id doesn't work when element is not rooted in DOM tree
https://bugs.webkit.org/show_bug.cgi?id=117836
Reviewed by Benjamin Poulain.
Source/WebCore:
When the root node of a HTML collection is not in the document or in a shadow tree,
we shouldn't use its tree scope's id and name maps to find name getters.
Always use the slow path in such cases.
Test: fast/dom/htmlallcollection-detached-node-children.html
* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::namedItem):
LayoutTests:
Add a regression test for named getter for a detached element.
* fast/dom/htmlallcollection-detached-node-children-expected.txt: Added.
* fast/dom/htmlallcollection-detached-node-children.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (151820 => 151821)
--- trunk/LayoutTests/ChangeLog 2013-06-21 02:57:49 UTC (rev 151820)
+++ trunk/LayoutTests/ChangeLog 2013-06-21 03:50:47 UTC (rev 151821)
@@ -1,3 +1,15 @@
+2013-06-20 Ryosuke Niwa <[email protected]>
+
+ REGRESSION(r149652): accessing items in .children via id doesn't work when element is not rooted in DOM tree
+ https://bugs.webkit.org/show_bug.cgi?id=117836
+
+ Reviewed by Benjamin Poulain.
+
+ Add a regression test for named getter for a detached element.
+
+ * fast/dom/htmlallcollection-detached-node-children-expected.txt: Added.
+ * fast/dom/htmlallcollection-detached-node-children.html: Added.
+
2013-06-20 Ryuan Choi <[email protected]>
[CMAKE][EFL] Enable DOM4 Events Constructor
Added: trunk/LayoutTests/fast/dom/htmlallcollection-detached-node-children-expected.txt (0 => 151821)
--- trunk/LayoutTests/fast/dom/htmlallcollection-detached-node-children-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/htmlallcollection-detached-node-children-expected.txt 2013-06-21 03:50:47 UTC (rev 151821)
@@ -0,0 +1,13 @@
+This tests verifies that the name getter on element.children works even when element is not in the document
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS element.children['foo'] is undefined.
+PASS span = createElementWithId('foo'); element.appendChild(span); element.children['foo'] is span
+PASS document.all['foo'] is undefined.
+PASS document.body.appendChild(span); document.all['foo'] is span
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/dom/htmlallcollection-detached-node-children.html (0 => 151821)
--- trunk/LayoutTests/fast/dom/htmlallcollection-detached-node-children.html (rev 0)
+++ trunk/LayoutTests/fast/dom/htmlallcollection-detached-node-children.html 2013-06-21 03:50:47 UTC (rev 151821)
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script src=""
+</head>
+<body>
+<script>
+
+description("This tests verifies that the name getter on element.children works even when element is not in the document");
+
+function createElementWithId(id) {
+ var span = document.createElement('span');
+ span.id = 'foo';
+ return span;
+}
+
+var element = document.createElement('div');
+shouldBeUndefined("element.children['foo']");
+shouldBe("span = createElementWithId('foo'); element.appendChild(span); element.children['foo']", "span");
+shouldBeUndefined("document.all['foo']");
+shouldBe("document.body.appendChild(span); document.all['foo']", "span");
+
+</script>
+<script src=""
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (151820 => 151821)
--- trunk/Source/WebCore/ChangeLog 2013-06-21 02:57:49 UTC (rev 151820)
+++ trunk/Source/WebCore/ChangeLog 2013-06-21 03:50:47 UTC (rev 151821)
@@ -1,3 +1,20 @@
+2013-06-20 Ryosuke Niwa <[email protected]>
+
+ REGRESSION(r149652): accessing items in .children via id doesn't work when element is not rooted in DOM tree
+ https://bugs.webkit.org/show_bug.cgi?id=117836
+
+ Reviewed by Benjamin Poulain.
+
+ When the root node of a HTML collection is not in the document or in a shadow tree,
+ we shouldn't use its tree scope's id and name maps to find name getters.
+
+ Always use the slow path in such cases.
+
+ Test: fast/dom/htmlallcollection-detached-node-children.html
+
+ * html/HTMLCollection.cpp:
+ (WebCore::HTMLCollection::namedItem):
+
2013-06-20 Alexey Proskuryakov <[email protected]>
https://bugs.webkit.org/show_bug.cgi?id=116495
Modified: trunk/Source/WebCore/html/HTMLCollection.cpp (151820 => 151821)
--- trunk/Source/WebCore/html/HTMLCollection.cpp 2013-06-21 02:57:49 UTC (rev 151820)
+++ trunk/Source/WebCore/html/HTMLCollection.cpp 2013-06-21 03:50:47 UTC (rev 151821)
@@ -615,7 +615,7 @@
if (name.isEmpty() || !root)
return 0;
- if (!overridesItemAfter()) {
+ if (!overridesItemAfter() && root->isInTreeScope()) {
TreeScope* treeScope = root->treeScope();
Element* candidate = 0;
if (treeScope->hasElementWithId(name.impl())) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
