[webkit-changes] [133485] branches/safari-536.28-branch

Mon, 05 Nov 2012 08:55:47 -0800

Title: [133485] branches/safari-536.28-branch

Diff

Modified: branches/safari-536.28-branch/LayoutTests/ChangeLog (133484 => 133485)


--- branches/safari-536.28-branch/LayoutTests/ChangeLog	2012-11-05 16:48:14 UTC (rev 133484)
+++ branches/safari-536.28-branch/LayoutTests/ChangeLog	2012-11-05 16:57:16 UTC (rev 133485)
@@ -1,5 +1,19 @@
 2012-11-05  Lucas Forschler  <lforsch...@apple.com>
 
+        Merge r125237
+
+    2012-08-09  MORITA Hajime  <morr...@google.com>
+
+            https://bugs.webkit.org/show_bug.cgi?id=93587
+            Node::replaceChild() can create bad DOM topology with MutationEvent, Part 2
+
+            Reviewed by Kent Tamura.
+
+            * fast/events/mutation-during-replace-child-2-expected.txt: Added.
+            * fast/events/mutation-during-replace-child-2.html: Added.
+
+2012-11-05  Lucas Forschler  <lforsch...@apple.com>
+
         Merge r125234
 
     2012-08-09  Julien Chaffraix  <jchaffr...@webkit.org>
@@ -10996,3 +11010,4 @@
 .
 .
 .
+.

Copied: branches/safari-536.28-branch/LayoutTests/fast/events/mutation-during-replace-child-2-expected.txt (from rev 125237, trunk/LayoutTests/fast/events/mutation-during-replace-child-2-expected.txt) (0 => 133485)


--- branches/safari-536.28-branch/LayoutTests/fast/events/mutation-during-replace-child-2-expected.txt	                        (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/events/mutation-during-replace-child-2-expected.txt	2012-11-05 16:57:16 UTC (rev 133485)
@@ -0,0 +1,10 @@
+Ensures that replaceChild() throws an exception if mutation even handler does something wrong
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS target.replaceChild(newChild, oldChild); threw exception Error: HIERARCHY_REQUEST_ERR: DOM Exception 3.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Copied: branches/safari-536.28-branch/LayoutTests/fast/events/mutation-during-replace-child-2.html (from rev 125237, trunk/LayoutTests/fast/events/mutation-during-replace-child-2.html) (0 => 133485)


--- branches/safari-536.28-branch/LayoutTests/fast/events/mutation-during-replace-child-2.html	                        (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/events/mutation-during-replace-child-2.html	2012-11-05 16:57:16 UTC (rev 133485)
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<div>
+  <div id="target">
+    <b></b><b id="oldChild"></b><b></b>
+  </div>
+  <div id="newChild"></div>
+</div>
+
+<script>
+description("Ensures that replaceChild() throws an exception if mutation even handler does something wrong");
+var target = document.getElementById('target');
+var oldChild = document.getElementById('oldChild');
+var newChild = document.getElementById('newChild');
+
+var numCalled = 0;
+
+function handler(){
+    numCalled++;
+    if (numCalled < 2)
+        return;
+    document.removeEventListener("DOMNodeRemoved", handler, false);
+    target.parentNode.removeChild(target);
+    newChild.appendChild(target);
+}   
+document.addEventListener("DOMNodeRemoved", handler, false);
+shouldThrow("target.replaceChild(newChild, oldChild);",  "'Error: HIERARCHY_REQUEST_ERR: DOM Exception 3'");
+</script>
+<script src=""
+</body>
+</html>
+

Modified: branches/safari-536.28-branch/Source/WebCore/ChangeLog (133484 => 133485)


--- branches/safari-536.28-branch/Source/WebCore/ChangeLog	2012-11-05 16:48:14 UTC (rev 133484)
+++ branches/safari-536.28-branch/Source/WebCore/ChangeLog	2012-11-05 16:57:16 UTC (rev 133485)
@@ -1,5 +1,24 @@
 2012-11-05  Lucas Forschler  <lforsch...@apple.com>
 
+        Merge r125237
+
+    2012-08-09  MORITA Hajime  <morr...@google.com>
+
+            https://bugs.webkit.org/show_bug.cgi?id=93587
+            Node::replaceChild() can create bad DOM topology with MutationEvent, Part 2
+
+            Reviewed by Kent Tamura.
+
+            This is a followup of r124156. replaceChild() has yet another hidden
+            MutationEvent trigger. This change added a guard for it.
+
+            Test: fast/events/mutation-during-replace-child-2.html
+
+            * dom/ContainerNode.cpp:
+            (WebCore::ContainerNode::replaceChild):
+
+2012-11-05  Lucas Forschler  <lforsch...@apple.com>
+
         Merge r125234
 
     2012-08-09  Julien Chaffraix  <jchaffr...@webkit.org>
@@ -206528,3 +206547,4 @@
 .
 .
 .
+.

Modified: branches/safari-536.28-branch/Source/WebCore/dom/ContainerNode.cpp (133484 => 133485)


--- branches/safari-536.28-branch/Source/WebCore/dom/ContainerNode.cpp	2012-11-05 16:48:14 UTC (rev 133484)
+++ branches/safari-536.28-branch/Source/WebCore/dom/ContainerNode.cpp	2012-11-05 16:57:16 UTC (rev 133485)
@@ -280,6 +280,11 @@
     if (ec)
         return false;
 
+    // Does this yet another check because collectChildrenAndRemoveFromOldParent() fires a MutationEvent.
+    checkReplaceChild(newChild.get(), oldChild, ec);
+    if (ec)
+        return false;
+
     InspectorInstrumentation::willInsertDOMNode(document(), this);
 
     // Add the new child(ren)

_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to