Title: [108980] trunk
- Revision
- 108980
- Author
- morr...@google.com
- Date
- 2012-02-27 03:13:44 -0800 (Mon, 27 Feb 2012)
Log Message
Source/WebCore: Removing <ul>, <li> inside shadow DOM triggers assertion in updateListMarkerNumbers
https://bugs.webkit.org/show_bug.cgi?id=79630
Reviewed by Ryosuke Niwa.
This problem was caused by the inconsistent detach order of DOM tree where
Element::detach() called ContainerNode::detach() before shadow tree is detached.
This resulted the renderer of the element being destroyed even if its children,
each of which came from an element in the shadow tree, are alive.
In principle, child renderers should be destroyed before its parent.
This change aligns the detach order with the attach order. The shadow tree is
now deatched before parent's ContainerNode::detach() is called.
Test: fast/dom/shadow/shadow-ul-li.html
* dom/Element.cpp:
(WebCore::Element::detach):
LayoutTests: Removing <ul>, <li> inside shadow DOM triggers assertion in updateListMarkerNumbers
https://bugs.webkit.org/show_bug.cgi?id=72440
Reviewed by Ryosuke Niwa.
* fast/dom/shadow/shadow-ul-li-expected.txt: Added.
* fast/dom/shadow/shadow-ul-li.html: Added.
* fast/dom/shadow/shadow-ul-li.html:
* platform/mac/Skipped:
* platform/qt/Skipped:
* platform/win/Skipped:
* platform/wk2/Skipped:
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (108979 => 108980)
--- trunk/LayoutTests/ChangeLog 2012-02-27 11:05:12 UTC (rev 108979)
+++ trunk/LayoutTests/ChangeLog 2012-02-27 11:13:44 UTC (rev 108980)
@@ -1,3 +1,18 @@
+2012-02-27 MORITA Hajime <morr...@google.com>
+
+ Removing <ul>, <li> inside shadow DOM triggers assertion in updateListMarkerNumbers
+ https://bugs.webkit.org/show_bug.cgi?id=72440
+
+ Reviewed by Ryosuke Niwa.
+
+ * fast/dom/shadow/shadow-ul-li-expected.txt: Added.
+ * fast/dom/shadow/shadow-ul-li.html: Added.
+ * fast/dom/shadow/shadow-ul-li.html:
+ * platform/mac/Skipped:
+ * platform/qt/Skipped:
+ * platform/win/Skipped:
+ * platform/wk2/Skipped:
+
2012-02-27 Csaba Osztrogonác <o...@webkit.org>
Unreviewed gardening.
Added: trunk/LayoutTests/fast/dom/shadow/shadow-ul-li-expected.txt (0 => 108980)
--- trunk/LayoutTests/fast/dom/shadow/shadow-ul-li-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/shadow-ul-li-expected.txt 2012-02-27 11:13:44 UTC (rev 108980)
@@ -0,0 +1 @@
+PASS unless crash.
Added: trunk/LayoutTests/fast/dom/shadow/shadow-ul-li.html (0 => 108980)
--- trunk/LayoutTests/fast/dom/shadow/shadow-ul-li.html (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/shadow-ul-li.html 2012-02-27 11:13:44 UTC (rev 108980)
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function test()
+{
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ var host = document.createElement('div');
+ document.body.appendChild(host);
+ var shadow = new WebKitShadowRoot(host);
+
+ var ul = document.createElement('ul');
+ var li = document.createElement('li');
+ ul.appendChild(li);
+ shadow.appendChild(ul);
+ document.body.offsetLeft;
+
+ document.body.innerHTML = 'PASS unless crash.';
+}
+</script>
+</head>
+<body _onload_="test()">
+</body>
+</html>
Modified: trunk/LayoutTests/platform/mac/Skipped (108979 => 108980)
--- trunk/LayoutTests/platform/mac/Skipped 2012-02-27 11:05:12 UTC (rev 108979)
+++ trunk/LayoutTests/platform/mac/Skipped 2012-02-27 11:13:44 UTC (rev 108980)
@@ -429,6 +429,7 @@
fast/dom/shadow/shadow-disable.html
fast/dom/shadow/shadow-root-attached.html
fast/dom/shadow/shadow-root-new.html
+fast/dom/shadow/shadow-ul-li.html
# JSC does not support setIsolatedWorldSecurityOrigin (http://webkit.org/b/61540)
http/tests/security/isolatedWorld/cross-origin-xhr.html
Modified: trunk/LayoutTests/platform/qt/Skipped (108979 => 108980)
--- trunk/LayoutTests/platform/qt/Skipped 2012-02-27 11:05:12 UTC (rev 108979)
+++ trunk/LayoutTests/platform/qt/Skipped 2012-02-27 11:13:44 UTC (rev 108980)
@@ -167,6 +167,7 @@
fast/dom/shadow/shadow-on-image.html
fast/dom/shadow/shadow-root-attached.html
fast/dom/shadow/shadow-root-new.html
+fast/dom/shadow/shadow-ul-li.html
# CSS Regions support not yet enabled. http://webkit.org/b/57312
fast/regions
Modified: trunk/LayoutTests/platform/win/Skipped (108979 => 108980)
--- trunk/LayoutTests/platform/win/Skipped 2012-02-27 11:05:12 UTC (rev 108979)
+++ trunk/LayoutTests/platform/win/Skipped 2012-02-27 11:13:44 UTC (rev 108980)
@@ -1458,6 +1458,7 @@
fast/dom/shadow/shadow-disable.html
fast/dom/shadow/shadow-root-attached.html
fast/dom/shadow/shadow-root-new.html
+fast/dom/shadow/shadow-ul-li.html
# CSS Regions support not yet enabled. http://webkit.org/b/57312
fast/regions
Modified: trunk/LayoutTests/platform/wk2/Skipped (108979 => 108980)
--- trunk/LayoutTests/platform/wk2/Skipped 2012-02-27 11:05:12 UTC (rev 108979)
+++ trunk/LayoutTests/platform/wk2/Skipped 2012-02-27 11:13:44 UTC (rev 108980)
@@ -1073,6 +1073,7 @@
fast/dom/shadow/shadow-disable.html
fast/dom/shadow/shadow-root-attached.html
fast/dom/shadow/shadow-root-new.html
+fast/dom/shadow/shadow-ul-li.html
# WTR needs an implementation for eventSender.continuousMouseScrollBy
# https://bugs.webkit.org/show_bug.cgi?id=69417
Modified: trunk/Source/WebCore/ChangeLog (108979 => 108980)
--- trunk/Source/WebCore/ChangeLog 2012-02-27 11:05:12 UTC (rev 108979)
+++ trunk/Source/WebCore/ChangeLog 2012-02-27 11:13:44 UTC (rev 108980)
@@ -1,3 +1,24 @@
+2012-02-27 MORITA Hajime <morr...@google.com>
+
+ Removing <ul>, <li> inside shadow DOM triggers assertion in updateListMarkerNumbers
+ https://bugs.webkit.org/show_bug.cgi?id=79630
+
+ Reviewed by Ryosuke Niwa.
+
+ This problem was caused by the inconsistent detach order of DOM tree where
+ Element::detach() called ContainerNode::detach() before shadow tree is detached.
+ This resulted the renderer of the element being destroyed even if its children,
+ each of which came from an element in the shadow tree, are alive.
+ In principle, child renderers should be destroyed before its parent.
+
+ This change aligns the detach order with the attach order. The shadow tree is
+ now deatched before parent's ContainerNode::detach() is called.
+
+ Test: fast/dom/shadow/shadow-ul-li.html
+
+ * dom/Element.cpp:
+ (WebCore::Element::detach):
+
2012-02-27 Keishi Hattori <kei...@webkit.org>
Color input type should be clickable through keyboard
Modified: trunk/Source/WebCore/dom/Element.cpp (108979 => 108980)
--- trunk/Source/WebCore/dom/Element.cpp 2012-02-27 11:05:12 UTC (rev 108979)
+++ trunk/Source/WebCore/dom/Element.cpp 2012-02-27 11:13:44 UTC (rev 108980)
@@ -964,10 +964,19 @@
cancelFocusAppearanceUpdate();
if (hasRareData())
rareData()->resetComputedStyle();
- ContainerNode::detach();
- if (ShadowTree* tree = shadowTree())
- tree->detach();
+ if (hasShadowRoot()) {
+ for (Node* child = firstChild(); child; child = child->nextSibling()) {
+ if (child->attached())
+ child->detach();
+ }
+
+ shadowTree()->detach();
+ Node::detach();
+ } else
+ ContainerNode::detach();
+
+
RenderWidget::resumeWidgetHierarchyUpdates();
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
