Title: [159389] trunk
- Revision
- 159389
- Author
- [email protected]
- Date
- 2013-11-17 13:37:25 -0800 (Sun, 17 Nov 2013)
Log Message
REGRESSION (r158774): Iteration over element children is broken
https://bugs.webkit.org/show_bug.cgi?id=124145
Source/WebCore:
Reviewed by Anders Carlsson.
Mutation during traversal invalidates the position cache. After the mid-point we start
traversing backwards as it the shortest path. However backward traversal of children-only
HTMLCollection was wrong and would end up going to descendants.
Reduction by [email protected].
Test: fast/dom/htmlcollection-children-mutation.html
* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::collectionTraverseBackward):
Traverse direct children only when m_shouldOnlyIncludeDirectChildren bit is set.
LayoutTests:
Reviewed by Anders Carlsson.
* fast/dom/htmlcollection-children-mutation-expected.txt: Added.
* fast/dom/htmlcollection-children-mutation.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (159388 => 159389)
--- trunk/LayoutTests/ChangeLog 2013-11-17 21:00:28 UTC (rev 159388)
+++ trunk/LayoutTests/ChangeLog 2013-11-17 21:37:25 UTC (rev 159389)
@@ -1,5 +1,15 @@
2013-11-17 Antti Koivisto <[email protected]>
+ REGRESSION (r158774): Iteration over element children is broken
+ https://bugs.webkit.org/show_bug.cgi?id=124145
+
+ Reviewed by Anders Carlsson.
+
+ * fast/dom/htmlcollection-children-mutation-expected.txt: Added.
+ * fast/dom/htmlcollection-children-mutation.html: Added.
+
+2013-11-17 Antti Koivisto <[email protected]>
+
Simple line path does not respect visibility:hidden
https://bugs.webkit.org/show_bug.cgi?id=124467
Added: trunk/LayoutTests/fast/dom/htmlcollection-children-mutation-expected.txt (0 => 159389)
--- trunk/LayoutTests/fast/dom/htmlcollection-children-mutation-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/htmlcollection-children-mutation-expected.txt 2013-11-17 21:37:25 UTC (rev 159389)
@@ -0,0 +1,15 @@
+Test traversing children using HTMLCollection while mutating DOM
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS child.firstChild.innerText is "child 0"
+PASS child.firstChild.innerText is "child 1"
+PASS child.firstChild.innerText is "child 2"
+PASS child.firstChild.innerText is "child 3"
+PASS child.firstChild.innerText is "child 4"
+PASS child is null
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/dom/htmlcollection-children-mutation.html (0 => 159389)
--- trunk/LayoutTests/fast/dom/htmlcollection-children-mutation.html (rev 0)
+++ trunk/LayoutTests/fast/dom/htmlcollection-children-mutation.html 2013-11-17 21:37:25 UTC (rev 159389)
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script src=""
+</head>
+<body>
+<div id="test" style="display:none">
+<div><span></span></div>
+<div><span></span></div>
+<div><span></span></div>
+<div><span></span></div>
+<div><span></span></div>
+</div>
+<script>
+
+description("Test traversing children using HTMLCollection while mutating DOM");
+
+try {
+var test = document.getElementById("test");
+for (var i = 0; i < test.children.length; i++)
+ test.children[i].firstChild.innerHTML = "child " + i;
+} catch(e) {}
+
+var child = test.firstElementChild;
+for (var i = 0; i < 5; i++) {
+ shouldBeEqualToString("child.firstChild.innerText", "child " + i);
+ child = child.nextElementSibling;
+}
+shouldBeNull("child");
+
+</script>
+<script src=""
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (159388 => 159389)
--- trunk/Source/WebCore/ChangeLog 2013-11-17 21:00:28 UTC (rev 159388)
+++ trunk/Source/WebCore/ChangeLog 2013-11-17 21:37:25 UTC (rev 159389)
@@ -1,3 +1,23 @@
+2013-11-17 Antti Koivisto <[email protected]>
+
+ REGRESSION (r158774): Iteration over element children is broken
+ https://bugs.webkit.org/show_bug.cgi?id=124145
+
+ Reviewed by Anders Carlsson.
+
+ Mutation during traversal invalidates the position cache. After the mid-point we start
+ traversing backwards as it the shortest path. However backward traversal of children-only
+ HTMLCollection was wrong and would end up going to descendants.
+
+ Reduction by [email protected].
+
+ Test: fast/dom/htmlcollection-children-mutation.html
+
+ * html/HTMLCollection.cpp:
+ (WebCore::HTMLCollection::collectionTraverseBackward):
+
+ Traverse direct children only when m_shouldOnlyIncludeDirectChildren bit is set.
+
2013-11-17 Zoltan Horvath <[email protected]>
Move LineLayoutState.h into rendering/line
Modified: trunk/Source/WebCore/html/HTMLCollection.cpp (159388 => 159389)
--- trunk/Source/WebCore/html/HTMLCollection.cpp 2013-11-17 21:00:28 UTC (rev 159388)
+++ trunk/Source/WebCore/html/HTMLCollection.cpp 2013-11-17 21:37:25 UTC (rev 159389)
@@ -354,6 +354,11 @@
// FIXME: This should be optimized similarly to the forward case.
auto& root = rootNode();
Element* element = ¤t;
+ if (m_shouldOnlyIncludeDirectChildren) {
+ for (; count && element ; --count)
+ element = iterateForPreviousElement(ElementTraversal::previousSibling(element));
+ return element;
+ }
for (; count && element ; --count)
element = iterateForPreviousElement(ElementTraversal::previous(element, &root));
return element;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
