https://bugs.webkit.org/show_bug.cgi?id=119780
Reviewed by Benjamin Poulain.
Source/WebCore:
The bug was caused by SelectorDataList::executeFastPathForIdSelector not verifying that
elements found by getAllElementsById are descendents of rootNode when there are multiple
elements of the same id. This resulted in querySelector and querySelectorAll of an element
returning nodes outside of the element.
Fixed the bug by checking this condition when we have multiple elements of the same id.
Test: fast/selectors/querySelector-id-with-multiple-elements-with-same-id.html
* dom/SelectorQuery.cpp:
(WebCore::SelectorDataList::executeFastPathForIdSelector):
LayoutTests:
* fast/selectors/querySelector-id-with-multiple-elements-with-same-id-expected.txt: Added.
* fast/selectors/querySelector-id-with-multiple-elements-with-same-id.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@154037
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2013-08-13 Ryosuke Niwa <rniwa@webkit.org>
+
+ REGRESSION(r150187): Safari fails to render allrecipe.com comment popups
+ https://bugs.webkit.org/show_bug.cgi?id=119780
+
+ Reviewed by Benjamin Poulain.
+
+ * fast/selectors/querySelector-id-with-multiple-elements-with-same-id-expected.txt: Added.
+ * fast/selectors/querySelector-id-with-multiple-elements-with-same-id.html: Added.
+
2013-08-13 Sam Weinig <sam@webkit.org>
[Re-land] Cleanup MediaQueryListListener
--- /dev/null
+This test makes sure WebKit element.querySelector("#foo") returns a descendent node of the element even when there are multiple elements with the id foo.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS container.querySelectorAll("#foo").length is 1
+PASS container.querySelectorAll("#foo")[0] is container.firstChild
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
--- /dev/null
+<!DOCTYPE html>
+<html>
+<body>
+<span id="foo"></span>
+<div id="container"><span id="foo"></span></div>
+</body>
+<script src="../js/resources/js-test-pre.js"></script>
+<script>
+description('This test makes sure WebKit element.querySelector("#foo") returns a descendent node of the element even when there are multiple elements with the id foo.');
+
+var container = document.getElementById('container');
+shouldBe('container.querySelectorAll("#foo").length', '1');
+shouldBe('container.querySelectorAll("#foo")[0]', 'container.firstChild');
+
+</script>
+<script src="../js/resources/js-test-post.js"></script>
+</html>
+2013-08-13 Ryosuke Niwa <rniwa@webkit.org>
+
+ REGRESSION(r150187): Safari fails to render allrecipe.com comment popups
+ https://bugs.webkit.org/show_bug.cgi?id=119780
+
+ Reviewed by Benjamin Poulain.
+
+ The bug was caused by SelectorDataList::executeFastPathForIdSelector not verifying that
+ elements found by getAllElementsById are descendents of rootNode when there are multiple
+ elements of the same id. This resulted in querySelector and querySelectorAll of an element
+ returning nodes outside of the element.
+
+ Fixed the bug by checking this condition when we have multiple elements of the same id.
+
+ Test: fast/selectors/querySelector-id-with-multiple-elements-with-same-id.html
+
+ * dom/SelectorQuery.cpp:
+ (WebCore::SelectorDataList::executeFastPathForIdSelector):
+
2013-08-12 Ryosuke Niwa <rniwa@webkit.org>
Fix orphan needsLayout state in RenderTextControlSingleLine
const Vector<Element*>* elements = rootNode->treeScope()->getAllElementsById(idToMatch);
ASSERT(elements);
size_t count = elements->size();
+ bool rootNodeIsTreeScopeRoot = isTreeScopeRoot(rootNode);
for (size_t i = 0; i < count; ++i) {
Element* element = elements->at(i);
- if (selectorMatches(selectorData, element, rootNode)) {
+ if ((rootNodeIsTreeScopeRoot || element->isDescendantOf(rootNode)) && selectorMatches(selectorData, element, rootNode)) {
matchedElements.append(element);
if (firstMatchOnly)
return;