Attr Nodes should not have children
authorcdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 5 May 2017 19:26:11 +0000 (19:26 +0000)
committercdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 5 May 2017 19:26:11 +0000 (19:26 +0000)
commit1ffead5bb0828d8332bf8e648eace48f97323c0c
tree761cfe4a583b870a094b71fd59714a96518d788e
parent561676337b94ea389e584426e0e0514bb8d9e906
Attr Nodes should not have children
https://bugs.webkit.org/show_bug.cgi?id=171688
<rdar://problem/31998412>

Reviewed by Andreas Kling.

Source/WebCore:

Attr Nodes should not have children as per the latest DOM specification:
- https://dom.spec.whatwg.org/#interface-attr
- https://dom.spec.whatwg.org/#dom-attr-value
- https://dom.spec.whatwg.org/#concept-node-ensure-pre-insertion-validity (Step 1)

Firefox and Chrome both have been matching the DOM specification for a while so I think
we should do the same. This aligns us with other browsers, simplifies the code, is
more efficient and the code being removed has been prone to security bugs.

Test: fast/dom/Attr/cannot-have-children.html

* dom/Attr.cpp:
(WebCore::Attr::Attr):
(WebCore::Attr::create):
(WebCore::Attr::setValue):
(WebCore::Attr::cloneNodeInternal):
* dom/Attr.h:
- Have Attr subclass Node instead of ContainerNode as it can no longer have children.
- Drop logic to dealing with children / creating a Text child.

* dom/CharacterData.cpp:
(WebCore::CharacterData::notifyParentAfterChange):
Drop useless check found by the compiler. parentNode() can no longer be an Attr node.

* dom/Node.cpp:
(WebCore::appendTextContent):
appendTextContent() is called by Node.TextContent(). For Attr Nodes, we should no longer traverse
its subtree to gather Text Nodes. Instead, we now return Attr.value, as per the specification:
- https://dom.spec.whatwg.org/#dom-node-textcontent

* dom/Range.cpp:
(WebCore::lengthOfContentsInNode):
As per https://dom.spec.whatwg.org/#concept-node-length, we should return the number of children
for Attr Nodes, which will always be 0.

* xml/XPathUtil.cpp:
(WebCore::XPath::isValidContextNode):
Always return true for TEXT_NODE as the !(node->parentNode() && node->parentNode()->isAttributeNode())
check will also with true now. This is because a parentNode() cannot be an Attribute Node.

LayoutTests:

* fast/dom/Attr/cannot-have-children-expected.txt: Added.
* fast/dom/Attr/cannot-have-children.html: Added.
Add layout test coverage. I have verified that this test passes in both
Firefox and Chrome.

* dom/html/level1/*: Removed legacy / outdated tests.
* dom/xhtml/level1/*: Removed legacy / outdated tests.

* fast/dom/Attr/child-nodes-cache-expected.txt: Removed.
* fast/dom/Attr/child-nodes-cache.html: Removed.
* fast/dom/Attr/child-nodes-length-cache-expected.txt: Removed.
* fast/dom/Attr/child-nodes-length-cache.html: Removed.
* fast/dom/Attr/invalidate-nodelist-after-attr-setvalue-expected.txt: Removed.
* fast/dom/Attr/invalidate-nodelist-after-attr-setvalue.html: Removed.
* fast/dom/attribute-change-on-mutate-expected.txt: Removed.
* fast/dom/attribute-change-on-mutate.html: Removed.
* svg/custom/image-with-attr-change-after-delete-crash-expected.txt: Removed.
* svg/custom/image-with-attr-change-after-delete-crash.html: Removed.
* traversal/moz-bug590771-expected.txt: Removed.
* traversal/moz-bug590771.html: Removed.
Removed some outdated tests.

* fast/custom-elements/reactions-for-webkit-extensions-expected.txt:
* fast/custom-elements/reactions-for-webkit-extensions.html:
* fast/dom/Attr/change-id-via-attr-node-value-expected.txt:
* fast/dom/Attr/change-id-via-attr-node-value.html:
* fast/dom/Element/normalize-crash.html:
* fast/dom/Element/normalize-crash2.html:
* fast/dom/HTMLLinkElement/event-while-removing-attribute-expected.txt:
* fast/dom/HTMLLinkElement/event-while-removing-attribute.html:
* fast/dom/MutationObserver/observe-attributes-expected.txt:
* fast/dom/MutationObserver/observe-attributes.html:
* fast/dom/import-attribute-node.html:
* fast/dom/insertedIntoDocument-child.html:
* fast/dom/insertedIntoDocument-sibling.html:
* fast/dom/no-assert-for-malformed-js-url-attribute-expected.txt:
* fast/dom/no-assert-for-malformed-js-url-attribute.html:
* fast/dom/normalize-attributes-mutation-event-crash.html:
* fast/dom/serialize-nodes.xhtml:
* http/tests/security/xss-DENIED-iframe-src-alias-expected.txt:
Update existing tests so they stop relying on Attr Node having Text children.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@216259 268f45cc-cd09-0410-ab3c-d52691b4dbfc
211 files changed:
LayoutTests/ChangeLog
LayoutTests/dom/html/level1/core/hc_attrappendchild1-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild1.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild1.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild2-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild2.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild2.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild3-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild3.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild3.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild4-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild4.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild4.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild5-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild5.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild5.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild6-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild6.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrappendchild6.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrchildnodes1-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrchildnodes1.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrchildnodes1.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrchildnodes2-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrchildnodes2.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrchildnodes2.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrclonenode1-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrclonenode1.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrclonenode1.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrfirstchild-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrfirstchild.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrfirstchild.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrhaschildnodes-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrhaschildnodes.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrhaschildnodes.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore1-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore1.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore1.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore2-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore2.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore2.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore3-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore3.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore3.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore4-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore4.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore4.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore5-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore5.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore5.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore6-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore6.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore6.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore7-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore7.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrinsertbefore7.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrlastchild-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrlastchild.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrlastchild.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrnormalize-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrnormalize.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrnormalize.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrremovechild1-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrremovechild1.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrremovechild1.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrreplacechild1-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrreplacechild1.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrreplacechild1.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrreplacechild2-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrreplacechild2.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrreplacechild2.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrsetvalue1-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrsetvalue1.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrsetvalue1.js [deleted file]
LayoutTests/dom/html/level1/core/hc_attrsetvalue2-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_attrsetvalue2.html [deleted file]
LayoutTests/dom/html/level1/core/hc_attrsetvalue2.js [deleted file]
LayoutTests/dom/html/level1/core/hc_elementnormalize2-expected.txt [deleted file]
LayoutTests/dom/html/level1/core/hc_elementnormalize2.html [deleted file]
LayoutTests/dom/html/level1/core/hc_elementnormalize2.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild1-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild1.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild1.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild2-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild2.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild2.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild3-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild3.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild3.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild4-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild4.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild4.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild5-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild5.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild5.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild6-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild6.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrappendchild6.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrchildnodes1-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrchildnodes1.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrchildnodes1.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrchildnodes2-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrchildnodes2.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrchildnodes2.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrclonenode1-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrclonenode1.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrclonenode1.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrfirstchild-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrfirstchild.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrfirstchild.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrhaschildnodes-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrhaschildnodes.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrhaschildnodes.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore1-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore1.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore1.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore2-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore2.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore2.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore3-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore3.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore3.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore4-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore4.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore4.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore5-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore5.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore5.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore6-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore6.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore6.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore7-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore7.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrinsertbefore7.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrlastchild-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrlastchild.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrlastchild.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrnormalize-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrnormalize.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrnormalize.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrremovechild1-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrremovechild1.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrremovechild1.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrreplacechild1-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrreplacechild1.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrreplacechild1.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrreplacechild2-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrreplacechild2.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrreplacechild2.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrsetvalue1-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrsetvalue1.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrsetvalue1.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrsetvalue2-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrsetvalue2.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_attrsetvalue2.xhtml [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_elementnormalize2-expected.txt [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_elementnormalize2.js [deleted file]
LayoutTests/dom/xhtml/level1/core/hc_elementnormalize2.xhtml [deleted file]
LayoutTests/dom/xhtml/level3/core/documentadoptnode01-expected.txt [deleted file]
LayoutTests/dom/xhtml/level3/core/documentadoptnode01.js [deleted file]
LayoutTests/dom/xhtml/level3/core/documentadoptnode01.xhtml [deleted file]
LayoutTests/dom/xhtml/level3/core/documentadoptnode02-expected.txt [deleted file]
LayoutTests/dom/xhtml/level3/core/documentadoptnode02.js [deleted file]
LayoutTests/dom/xhtml/level3/core/documentadoptnode02.xhtml [deleted file]
LayoutTests/dom/xhtml/level3/core/noderemovechild28-expected.txt [deleted file]
LayoutTests/dom/xhtml/level3/core/noderemovechild28.js [deleted file]
LayoutTests/dom/xhtml/level3/core/noderemovechild28.xhtml [deleted file]
LayoutTests/dom/xhtml/level3/core/noderemovechild29-expected.txt [deleted file]
LayoutTests/dom/xhtml/level3/core/noderemovechild29.js [deleted file]
LayoutTests/dom/xhtml/level3/core/noderemovechild29.xhtml [deleted file]
LayoutTests/dom/xhtml/level3/core/noderemovechild30-expected.txt [deleted file]
LayoutTests/dom/xhtml/level3/core/noderemovechild30.js [deleted file]
LayoutTests/dom/xhtml/level3/core/noderemovechild30.xhtml [deleted file]
LayoutTests/fast/custom-elements/reactions-for-webkit-extensions-expected.txt
LayoutTests/fast/custom-elements/reactions-for-webkit-extensions.html
LayoutTests/fast/dom/Attr/cannot-have-children-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/Attr/cannot-have-children.html [new file with mode: 0644]
LayoutTests/fast/dom/Attr/change-id-via-attr-node-value-expected.txt
LayoutTests/fast/dom/Attr/change-id-via-attr-node-value.html
LayoutTests/fast/dom/Attr/child-nodes-cache-expected.txt [deleted file]
LayoutTests/fast/dom/Attr/child-nodes-cache.html [deleted file]
LayoutTests/fast/dom/Attr/child-nodes-length-cache-expected.txt [deleted file]
LayoutTests/fast/dom/Attr/child-nodes-length-cache.html [deleted file]
LayoutTests/fast/dom/Attr/invalidate-nodelist-after-attr-setvalue-expected.txt [deleted file]
LayoutTests/fast/dom/Attr/invalidate-nodelist-after-attr-setvalue.html [deleted file]
LayoutTests/fast/dom/Element/normalize-crash.html
LayoutTests/fast/dom/Element/normalize-crash2.html
LayoutTests/fast/dom/HTMLLinkElement/event-while-removing-attribute-expected.txt
LayoutTests/fast/dom/HTMLLinkElement/event-while-removing-attribute.html
LayoutTests/fast/dom/MutationObserver/observe-attributes-expected.txt
LayoutTests/fast/dom/MutationObserver/observe-attributes.html
LayoutTests/fast/dom/attribute-change-on-mutate-expected.txt [deleted file]
LayoutTests/fast/dom/attribute-change-on-mutate.html [deleted file]
LayoutTests/fast/dom/import-attribute-node.html
LayoutTests/fast/dom/insertedIntoDocument-child.html
LayoutTests/fast/dom/insertedIntoDocument-sibling.html
LayoutTests/fast/dom/no-assert-for-malformed-js-url-attribute-expected.txt
LayoutTests/fast/dom/no-assert-for-malformed-js-url-attribute.html
LayoutTests/fast/dom/normalize-attributes-mutation-event-crash.html
LayoutTests/fast/dom/serialize-nodes.xhtml
LayoutTests/http/tests/security/xss-DENIED-iframe-src-alias-expected.txt
LayoutTests/svg/custom/image-with-attr-change-after-delete-crash-expected.txt [deleted file]
LayoutTests/svg/custom/image-with-attr-change-after-delete-crash.html [deleted file]
LayoutTests/traversal/moz-bug590771-expected.txt [deleted file]
LayoutTests/traversal/moz-bug590771.html [deleted file]
Source/WebCore/ChangeLog
Source/WebCore/dom/Attr.cpp
Source/WebCore/dom/Attr.h
Source/WebCore/dom/CharacterData.cpp
Source/WebCore/dom/Node.cpp
Source/WebCore/dom/Range.cpp
Source/WebCore/xml/XPathUtil.cpp