Reviewed by Adam Roben.
- fix <rdar://problem/
5538651> REGRESSSION: domfuzz: null deref in WebCore::Document::canReplaceChild
Test: fast/dom/Document/replaceChild-null-oldChild.html
* dom/Document.cpp:
(WebCore::Document::canReplaceChild):
LayoutTests:
Reviewed by Adam Roben.
- test for <rdar://problem/
5538651> REGRESSSION: domfuzz: null deref in WebCore::Document::canReplaceChild
* fast/dom/Document/replaceChild-null-oldChild-expected.txt: Added.
* fast/dom/Document/replaceChild-null-oldChild.html: Added.
* fast/dom/Document/resources/replaceChild-null-oldChild.js: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@28354
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2007-12-03 Dan Bernstein <mitz@apple.com>
+
+ Reviewed by Adam Roben.
+
+ - test for <rdar://problem/5538651> REGRESSSION: domfuzz: null deref in WebCore::Document::canReplaceChild
+
+ * fast/dom/Document/replaceChild-null-oldChild-expected.txt: Added.
+ * fast/dom/Document/replaceChild-null-oldChild.html: Added.
+ * fast/dom/Document/resources/replaceChild-null-oldChild.js: Added.
+
2007-12-02 Darin Adler <darin@apple.com>
Reviewed by Mitz.
--- /dev/null
+Test behavior of Document.replaceChild() when oldChild is null.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS document.replaceChild(document.firstChild, null) threw exception Error: NOT_FOUND_ERR: DOM Exception 8.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
--- /dev/null
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css">
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="resources/replaceChild-null-oldChild.js"></script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
--- /dev/null
+description('Test behavior of Document.replaceChild() when oldChild is null.');
+
+shouldThrow('document.replaceChild(document.firstChild, null)', '"Error: NOT_FOUND_ERR: DOM Exception 8"');
+
+var successfullyParsed = true;
+2007-12-03 Dan Bernstein <mitz@apple.com>
+
+ Reviewed by Adam Roben.
+
+ - fix <rdar://problem/5538651> REGRESSSION: domfuzz: null deref in WebCore::Document::canReplaceChild
+
+ Test: fast/dom/Document/replaceChild-null-oldChild.html
+
+ * dom/Document.cpp:
+ (WebCore::Document::canReplaceChild):
+
2007-12-03 Holger Hans Peter Freyther <holger.freyther@trolltech.com>
Reviewed by Simon.
bool Document::canReplaceChild(Node* newChild, Node* oldChild)
{
+ if (!oldChild)
+ // ContainerNode::replaceChild will raise a NOT_FOUND_ERR.
+ return true;
+
if (oldChild->nodeType() == newChild->nodeType())
return true;