REGRESSION(r149652): accessing items in .children via id doesn't work when element...
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 21 Jun 2013 03:50:47 +0000 (03:50 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 21 Jun 2013 03:50:47 +0000 (03:50 +0000)
https://bugs.webkit.org/show_bug.cgi?id=117836

Reviewed by Benjamin Poulain.

Source/WebCore:

When the root node of a HTML collection is not in the document or in a shadow tree,
we shouldn't use its tree scope's id and name maps to find name getters.

Always use the slow path in such cases.

Test: fast/dom/htmlallcollection-detached-node-children.html

* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::namedItem):

LayoutTests:

Add a regression test for named getter for a detached element.

* fast/dom/htmlallcollection-detached-node-children-expected.txt: Added.
* fast/dom/htmlallcollection-detached-node-children.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@151821 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/dom/htmlallcollection-detached-node-children-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/htmlallcollection-detached-node-children.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/html/HTMLCollection.cpp

index 790250d2679324bba69771ce4f90e776947921e5..89a31d44ec14d7c6ad3887e3b17a68da6a16f1e2 100644 (file)
@@ -1,3 +1,15 @@
+2013-06-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r149652): accessing items in .children via id doesn't work when element is not rooted in DOM tree
+        https://bugs.webkit.org/show_bug.cgi?id=117836
+
+        Reviewed by Benjamin Poulain.
+
+        Add a regression test for named getter for a detached element.
+
+        * fast/dom/htmlallcollection-detached-node-children-expected.txt: Added.
+        * fast/dom/htmlallcollection-detached-node-children.html: Added.
+
 2013-06-20  Ryuan Choi  <ryuan.choi@samsung.com>
 
         [CMAKE][EFL] Enable DOM4 Events Constructor
diff --git a/LayoutTests/fast/dom/htmlallcollection-detached-node-children-expected.txt b/LayoutTests/fast/dom/htmlallcollection-detached-node-children-expected.txt
new file mode 100644 (file)
index 0000000..e10a370
--- /dev/null
@@ -0,0 +1,13 @@
+This tests verifies that the name getter on element.children works even when element is not in the document
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS element.children['foo'] is undefined.
+PASS span = createElementWithId('foo'); element.appendChild(span); element.children['foo'] is span
+PASS document.all['foo'] is undefined.
+PASS document.body.appendChild(span); document.all['foo'] is span
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/dom/htmlallcollection-detached-node-children.html b/LayoutTests/fast/dom/htmlallcollection-detached-node-children.html
new file mode 100644 (file)
index 0000000..ce815c4
--- /dev/null
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script src="../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<script>
+
+description("This tests verifies that the name getter on element.children works even when element is not in the document");
+
+function createElementWithId(id) {
+    var span = document.createElement('span');
+    span.id = 'foo';
+    return span;
+}
+
+var element = document.createElement('div');
+shouldBeUndefined("element.children['foo']");
+shouldBe("span = createElementWithId('foo'); element.appendChild(span); element.children['foo']", "span");
+shouldBeUndefined("document.all['foo']");
+shouldBe("document.body.appendChild(span); document.all['foo']", "span");
+
+</script>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
index 40d2e4c41c505608d0fd2fdb145e25fe5344ac7d..f4f7931a71c055c0fe9e116263424e74eff90d45 100644 (file)
@@ -1,3 +1,20 @@
+2013-06-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r149652): accessing items in .children via id doesn't work when element is not rooted in DOM tree
+        https://bugs.webkit.org/show_bug.cgi?id=117836
+
+        Reviewed by Benjamin Poulain.
+
+        When the root node of a HTML collection is not in the document or in a shadow tree,
+        we shouldn't use its tree scope's id and name maps to find name getters.
+
+        Always use the slow path in such cases.
+
+        Test: fast/dom/htmlallcollection-detached-node-children.html
+
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::namedItem):
+
 2013-06-20  Alexey Proskuryakov  <ap@apple.com>
 
         https://bugs.webkit.org/show_bug.cgi?id=116495
index 36e1d5346f61157876f2d84ccea6f8f2a238597f..4b59ddecd9a32f983e255290875a8ca3a5ab860a 100644 (file)
@@ -615,7 +615,7 @@ Node* HTMLCollection::namedItem(const AtomicString& name) const
     if (name.isEmpty() || !root)
         return 0;
 
-    if (!overridesItemAfter()) {
+    if (!overridesItemAfter() && root->isInTreeScope()) {
         TreeScope* treeScope = root->treeScope();
         Element* candidate = 0;
         if (treeScope->hasElementWithId(name.impl())) {