Title: [212027] trunk
- Revision
- 212027
- Author
- bfulg...@apple.com
- Date
- 2017-02-09 18:17:05 -0800 (Thu, 09 Feb 2017)
Log Message
Details element doesn't work correctly when mutating content between closing and opening
https://bugs.webkit.org/show_bug.cgi?id=167310
Patch by Antti Koivisto <an...@apple.com> on 2017-02-09
Reviewed by Ryosuke Niwa.
Source/WebCore:
Tests: fast/html/details-close-modify-open.html
fast/shadow-dom/slot-remove-mutate-add.html
* dom/SlotAssignment.cpp:
(WebCore::SlotAssignment::didChangeSlot):
Always reset the slot assignment when content is mutated.
LayoutTests:
* fast/html/details-close-modify-open-expected.html: Added.
* fast/html/details-close-modify-open.html: Added.
* fast/shadow-dom/slot-remove-mutate-add-expected.html: Added.
* fast/shadow-dom/slot-remove-mutate-add.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (212026 => 212027)
--- trunk/LayoutTests/ChangeLog 2017-02-10 02:15:02 UTC (rev 212026)
+++ trunk/LayoutTests/ChangeLog 2017-02-10 02:17:05 UTC (rev 212027)
@@ -1,3 +1,15 @@
+2017-02-09 Antti Koivisto <an...@apple.com>
+
+ Details element doesn't work correctly when mutating content between closing and opening
+ https://bugs.webkit.org/show_bug.cgi?id=167310
+
+ Reviewed by Ryosuke Niwa.
+
+ * fast/html/details-close-modify-open-expected.html: Added.
+ * fast/html/details-close-modify-open.html: Added.
+ * fast/shadow-dom/slot-remove-mutate-add-expected.html: Added.
+ * fast/shadow-dom/slot-remove-mutate-add.html: Added.
+
2017-02-09 Chris Dumez <cdu...@apple.com>
Crash under FormSubmission::create()
Added: trunk/LayoutTests/fast/html/details-close-modify-open-expected.html (0 => 212027)
--- trunk/LayoutTests/fast/html/details-close-modify-open-expected.html (rev 0)
+++ trunk/LayoutTests/fast/html/details-close-modify-open-expected.html 2017-02-10 02:17:05 UTC (rev 212027)
@@ -0,0 +1,3 @@
+<details open>
+foo
+</details>
Added: trunk/LayoutTests/fast/html/details-close-modify-open.html (0 => 212027)
--- trunk/LayoutTests/fast/html/details-close-modify-open.html (rev 0)
+++ trunk/LayoutTests/fast/html/details-close-modify-open.html 2017-02-10 02:17:05 UTC (rev 212027)
@@ -0,0 +1,10 @@
+<script>
+function go() {
+ d.open = false;
+ d.innerHTML = "foo";
+ d.open = true;
+}
+</script>
+<body _onload_=go()>
+<details id="d" open="true">
+<div></div>
Added: trunk/LayoutTests/fast/shadow-dom/slot-remove-mutate-add-expected.html (0 => 212027)
--- trunk/LayoutTests/fast/shadow-dom/slot-remove-mutate-add-expected.html (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/slot-remove-mutate-add-expected.html 2017-02-10 02:17:05 UTC (rev 212027)
@@ -0,0 +1 @@
+foo
Added: trunk/LayoutTests/fast/shadow-dom/slot-remove-mutate-add.html (0 => 212027)
--- trunk/LayoutTests/fast/shadow-dom/slot-remove-mutate-add.html (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/slot-remove-mutate-add.html 2017-02-10 02:17:05 UTC (rev 212027)
@@ -0,0 +1,10 @@
+<body>
+<div id="d"><div></div></div>
+<script>
+const shadow = d.attachShadow({mode:"open"});
+shadow.innerHTML = `<slot></slot>`;
+d.offsetWidth;
+shadow.innerHTML = ``;
+d.innerHTML = "foo";
+shadow.innerHTML = `<slot></slot>`;
+</script>
Modified: trunk/Source/WebCore/ChangeLog (212026 => 212027)
--- trunk/Source/WebCore/ChangeLog 2017-02-10 02:15:02 UTC (rev 212026)
+++ trunk/Source/WebCore/ChangeLog 2017-02-10 02:17:05 UTC (rev 212027)
@@ -1,3 +1,18 @@
+2017-02-09 Antti Koivisto <an...@apple.com>
+
+ Details element doesn't work correctly when mutating content between closing and opening
+ https://bugs.webkit.org/show_bug.cgi?id=167310
+
+ Reviewed by Ryosuke Niwa.
+
+ Tests: fast/html/details-close-modify-open.html
+ fast/shadow-dom/slot-remove-mutate-add.html
+
+ * dom/SlotAssignment.cpp:
+ (WebCore::SlotAssignment::didChangeSlot):
+
+ Always reset the slot assignment when content is mutated.
+
2017-02-09 Chris Dumez <cdu...@apple.com>
Crash under FormSubmission::create()
Modified: trunk/Source/WebCore/dom/SlotAssignment.cpp (212026 => 212027)
--- trunk/Source/WebCore/dom/SlotAssignment.cpp 2017-02-10 02:15:02 UTC (rev 212026)
+++ trunk/Source/WebCore/dom/SlotAssignment.cpp 2017-02-10 02:17:05 UTC (rev 212027)
@@ -133,6 +133,9 @@
auto it = m_slots.find(slotName);
if (it == m_slots.end())
return;
+
+ it->value->assignedNodes.clear();
+ m_slotAssignmentsIsValid = false;
HTMLSlotElement* slotElement = findFirstSlotElement(*it->value, shadowRoot);
if (!slotElement)
@@ -139,7 +142,6 @@
return;
shadowRoot.host()->invalidateStyleAndRenderersForSubtree();
- m_slotAssignmentsIsValid = false;
if (shadowRoot.mode() == ShadowRootMode::UserAgent)
return;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
