REGRESSION (r158774): Iteration over element children is broken
authorantti@apple.com <antti@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 17 Nov 2013 21:37:25 +0000 (21:37 +0000)
committerantti@apple.com <antti@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 17 Nov 2013 21:37:25 +0000 (21:37 +0000)
commit648f5f1871b287d5e12cd8a206397048ef80bf65
treec6a5a3aedf6438b109527cabb3e7b69cd35f69ae
parent74e48068b4dca6f82e24dea14975d739736006af
REGRESSION (r158774): Iteration over element children is broken
https://bugs.webkit.org/show_bug.cgi?id=124145

Source/WebCore:

Reviewed by Anders Carlsson.

Mutation during traversal invalidates the position cache. After the mid-point we start
traversing backwards as it the shortest path. However backward traversal of children-only
HTMLCollection was wrong and would end up going to descendants.

Reduction by yannick.poirier@inverto.tv.

Test: fast/dom/htmlcollection-children-mutation.html

* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::collectionTraverseBackward):

    Traverse direct children only when m_shouldOnlyIncludeDirectChildren bit is set.

LayoutTests:

Reviewed by Anders Carlsson.

* fast/dom/htmlcollection-children-mutation-expected.txt: Added.
* fast/dom/htmlcollection-children-mutation.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@159389 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/dom/htmlcollection-children-mutation-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/htmlcollection-children-mutation.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/html/HTMLCollection.cpp