getElementById can return a wrong elemnt when a matching element is removed during...
authorbfulgham@apple.com <bfulgham@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 17 May 2017 17:15:45 +0000 (17:15 +0000)
committerbfulgham@apple.com <bfulgham@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 17 May 2017 17:15:45 +0000 (17:15 +0000)
commitbbdceb49035684db135a9b07b729158d442f4e4e
tree7f8a106920cfae2a2e8ebae978db2ad6a419fa45
parent938c5abeea9c4c75b5b22f061cf18037e63fb021
getElementById can return a wrong elemnt when a matching element is removed during beforeload event
https://bugs.webkit.org/show_bug.cgi?id=171374

Patch by Ryosuke Niwa <rniwa@webkit.org> on 2017-05-17
Reviewed by Brent Fulgham.

Source/WebCore:

The bug was caused by HTMLLinkElement firing beforeload event inside insertedInto before the tree state is updated.
Delay the event dispatch to the post insertion callback.

Test: fast/html/link-element-removal-during-beforeload.html

* html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::insertedInto):
(WebCore::HTMLLinkElement::finishedInsertingSubtree):
* html/HTMLLinkElement.h:

LayoutTests:

Added a regression test for calling getElementById after removing a matching element
during beforeload event of a link element.

* fast/html/link-element-removal-during-beforeload-expected.txt: Added.
* fast/html/link-element-removal-during-beforeload.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@216978 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/html/link-element-removal-during-beforeload-expected.txt [new file with mode: 0644]
LayoutTests/fast/html/link-element-removal-during-beforeload.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/html/HTMLLinkElement.cpp
Source/WebCore/html/HTMLLinkElement.h