2011-03-07 Sergey Glazunov <serg.glazunov@gmail.com>
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 7 Mar 2011 20:10:08 +0000 (20:10 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 7 Mar 2011 20:10:08 +0000 (20:10 +0000)
        Reviewed by Dimitri Glazkov.

        Node::checkAddChild and Node::checkReplaceChild shouldn't change the owner document of a node
        https://bugs.webkit.org/show_bug.cgi?id=55803

        * fast/dom/dom-method-document-change-expected.txt: Added.
        * fast/dom/dom-method-document-change.html: Added.
2011-03-07  Sergey Glazunov  <serg.glazunov@gmail.com>

        Reviewed by Dimitri Glazkov.

        Node::checkAddChild and Node::checkReplaceChild shouldn't change the owner document of a node
        https://bugs.webkit.org/show_bug.cgi?id=55803

        Test: fast/dom/dom-method-document-change.html

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::insertBefore):
        (WebCore::ContainerNode::replaceChild):
        (WebCore::ContainerNode::appendChild):
        * dom/Node.cpp:
        (WebCore::Node::checkReplaceChild):
        (WebCore::Node::checkAddChild):
        * dom/Node.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@80487 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/dom/dom-method-document-change-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/dom-method-document-change.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/dom/ContainerNode.cpp
Source/WebCore/dom/Node.cpp
Source/WebCore/dom/Node.h

index ae1a94b..c069be1 100644 (file)
@@ -1,3 +1,13 @@
+2011-03-07  Sergey Glazunov  <serg.glazunov@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Node::checkAddChild and Node::checkReplaceChild shouldn't change the owner document of a node
+        https://bugs.webkit.org/show_bug.cgi?id=55803
+
+        * fast/dom/dom-method-document-change-expected.txt: Added.
+        * fast/dom/dom-method-document-change.html: Added.
+
 2011-03-07  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed, rolling out r80484.
diff --git a/LayoutTests/fast/dom/dom-method-document-change-expected.txt b/LayoutTests/fast/dom/dom-method-document-change-expected.txt
new file mode 100644 (file)
index 0000000..ff43ca4
--- /dev/null
@@ -0,0 +1 @@
+SUCCESS
diff --git a/LayoutTests/fast/dom/dom-method-document-change.html b/LayoutTests/fast/dom/dom-method-document-change.html
new file mode 100644 (file)
index 0000000..efeec86
--- /dev/null
@@ -0,0 +1,54 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+handler = function()
+{
+    this.removeEventListener("DOMNodeRemoved", handler, false);
+    doc.adoptNode(this.parentElement);
+}
+
+showFailure = function(s)
+{
+    document.body.innerHTML = "FAILURE: " + s;
+}
+
+window.onload = function()
+{
+    element1 = document.createElement();
+    element2 = document.createElement();
+    element3 = document.createElement();
+    parent   = document.createElement();
+    dummy    = document.createElement();
+    
+    doc = document.implementation.createHTMLDocument();
+    
+    parent.appendChild(element1);
+    element1.addEventListener("DOMNodeRemoved", handler, false);
+    try {
+        document.body.appendChild(element1);
+    } catch (e) { }
+    if (element1.ownerDocument != element1.parentElement.ownerDocument)
+        return showFailure("appendChild");
+    
+    document.adoptNode(parent);
+    parent.appendChild(element2);
+    try {
+        doc.body.insertBefore(element2, dummy);
+    } catch (e) { }
+    if (element2.ownerDocument != element2.parentElement.ownerDocument)
+        return showFailure("insertBefore");
+    
+    parent.appendChild(element3);
+    try {
+        doc.body.replaceChild(element3, dummy);
+    } catch (e) { }
+    if (element3.ownerDocument != element3.parentElement.ownerDocument)
+        return showFailure("replaceChild");
+}
+</script>
+</head>
+<body>SUCCESS</body>
+</html>
index 1257a88..24e4e36 100644 (file)
@@ -1,3 +1,21 @@
+2011-03-07  Sergey Glazunov  <serg.glazunov@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Node::checkAddChild and Node::checkReplaceChild shouldn't change the owner document of a node
+        https://bugs.webkit.org/show_bug.cgi?id=55803
+
+        Test: fast/dom/dom-method-document-change.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::appendChild):
+        * dom/Node.cpp:
+        (WebCore::Node::checkReplaceChild):
+        (WebCore::Node::checkAddChild):
+        * dom/Node.h:
+
 2011-03-07  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed, rolling out r80484.
index 5945b13..7424875 100644 (file)
@@ -158,6 +158,7 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         InspectorInstrumentation::willInsertDOMNode(document(), child, this);
 #endif
 
+        child->setDocumentRecursively(document());
         insertBeforeCommon(next.get(), child);
 
         // Send notification about the children change.
@@ -306,6 +307,8 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         InspectorInstrumentation::willInsertDOMNode(document(), child.get(), this);
 #endif
 
+        child->setDocumentRecursively(document());
+
         // Add child after "prev".
         forbidEventDispatch();
         Node* next;
@@ -594,6 +597,8 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
         InspectorInstrumentation::willInsertDOMNode(document(), child, this);
 #endif
 
+        child->setDocumentRecursively(document());
+
         // Append child to the end of the list
         forbidEventDispatch();
         child->setParent(this);
index 8dd7b3e..6d6006b 100644 (file)
@@ -1189,8 +1189,6 @@ void Node::checkReplaceChild(Node* newChild, Node* oldChild, ExceptionCode& ec)
         ec = HIERARCHY_REQUEST_ERR;
         return;
     }
-
-    newChild->setDocumentRecursively(document());
 }
 
 void Node::checkAddChild(Node *newChild, ExceptionCode& ec)
@@ -1203,8 +1201,6 @@ void Node::checkAddChild(Node *newChild, ExceptionCode& ec)
         ec = HIERARCHY_REQUEST_ERR;
         return;
     }
-
-    newChild->setDocumentRecursively(document());
 }
 
 bool Node::isDescendantOf(const Node *other) const
index e6504aa..45043c8 100644 (file)
@@ -358,6 +358,9 @@ public:
     // removed from its previous document.
     void setDocument(Document*);
 
+    // Used by the basic DOM methods (e.g., appendChild()).
+    void setDocumentRecursively(Document*);
+
     // Returns true if this node is associated with a document and is in its associated document's
     // node tree, false otherwise.
     bool inDocument() const 
@@ -653,7 +656,6 @@ private:
     void markCachedNodeListsSlow(JSC::MarkStack&, JSC::JSGlobalData&);
 #endif
 
-    void setDocumentRecursively(Document*);
     void setStyleChange(StyleChangeType);
 
     // Used to share code between lazyAttach and setNeedsStyleRecalc.