LayoutTests:
authorggaren <ggaren@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 27 Mar 2007 02:36:38 +0000 (02:36 +0000)
committerggaren <ggaren@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 27 Mar 2007 02:36:38 +0000 (02:36 +0000)
        Reviewed by Darin Adler.

        Layout tests for <rdar://problem/5088234> REGRESSION: Crash occurs at
        WebCore::Node::createRendererIfNeeded() when changing map views with MS
        Virtual Earth (http://www.ziprealty.com/)

        * fast/dom/mutation-event-remove-inserted-node-expected.txt: Added.
        * fast/dom/mutation-event-remove-inserted-node.html: Added.
        * fast/dom/script-element-remove-self-expected.txt: Added.
        * fast/dom/script-element-remove-self.html: Added.

WebCore:

        Reviewed by Darin, landed by Anders.

        Manual test case for http://bugs.webkit.org/show_bug.cgi?id=13142

        * manual-tests/liveconnect-applet-get-boolean.html: Added.
        * manual-tests/resources/CheckerApplet.class: Added.
        * manual-tests/resources/CheckerApplet.java: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@20503 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/dom/mutation-event-remove-inserted-node-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/mutation-event-remove-inserted-node.html [new file with mode: 0644]
LayoutTests/fast/dom/script-element-remove-self-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/script-element-remove-self.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/dom/ContainerNode.cpp

index cd73b3e5c7551862fc425d5b3ee660958c696413..18552bcec05fbc3e97d31c4ef3305e9bc1418811 100644 (file)
@@ -1,3 +1,16 @@
+2007-03-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Layout tests for <rdar://problem/5088234> REGRESSION: Crash occurs at 
+        WebCore::Node::createRendererIfNeeded() when changing map views with MS 
+        Virtual Earth (http://www.ziprealty.com/)
+
+        * fast/dom/mutation-event-remove-inserted-node-expected.txt: Added.
+        * fast/dom/mutation-event-remove-inserted-node.html: Added.
+        * fast/dom/script-element-remove-self-expected.txt: Added.
+        * fast/dom/script-element-remove-self.html: Added.
+
 2007-03-26  Mitz Pettel  <mitz@webkit.org>
 
         Reviewed and landed by Darin.
diff --git a/LayoutTests/fast/dom/mutation-event-remove-inserted-node-expected.txt b/LayoutTests/fast/dom/mutation-event-remove-inserted-node-expected.txt
new file mode 100644 (file)
index 0000000..27f81ce
--- /dev/null
@@ -0,0 +1,5 @@
+This test verifies that a mutation event that removes inserted nodes from the document doesn't crash upon the insertion of a new node into the document.
+
+PASS: You didn't crash.
+
+
diff --git a/LayoutTests/fast/dom/mutation-event-remove-inserted-node.html b/LayoutTests/fast/dom/mutation-event-remove-inserted-node.html
new file mode 100644 (file)
index 0000000..aa321b2
--- /dev/null
@@ -0,0 +1,33 @@
+<body>
+
+<p>This test verifies that a mutation event that removes inserted nodes from the 
+document doesn't crash upon the insertion of a new node into the document.</p>
+<p>PASS: You didn't crash.</p>
+
+<script id="dummy"></script>
+
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function mutationListener(event)
+{
+    var element = event.srcElement;
+    element.parentNode.removeChild(element);
+}
+
+document.body.addEventListener("DOMNodeInserted", mutationListener, false);
+
+/* appendChild */
+document.body.appendChild(document.createElement("script"));
+
+/* insertBefore */
+document.body.insertBefore(document.createElement("script"), document.getElementById("dummy"));
+
+/* replaceChild */
+document.body.replaceChild(document.createElement("script"), document.getElementById("dummy"));
+
+/* Parser-inserted nodes don't fire mutation events. */
+</script>
+
+</body>
diff --git a/LayoutTests/fast/dom/script-element-remove-self-expected.txt b/LayoutTests/fast/dom/script-element-remove-self-expected.txt
new file mode 100644 (file)
index 0000000..338f619
--- /dev/null
@@ -0,0 +1,5 @@
+This test verifies that a <script> element that removes itself from the document doesn't crash upon insertion into the document.
+
+PASS: You didn't crash.
+
+
diff --git a/LayoutTests/fast/dom/script-element-remove-self.html b/LayoutTests/fast/dom/script-element-remove-self.html
new file mode 100644 (file)
index 0000000..fe29587
--- /dev/null
@@ -0,0 +1,40 @@
+<body>
+
+<p>This test verifies that a &lt;script&gt; element that removes itself 
+from the document doesn't crash upon insertion into the document.</p>
+<p>PASS: You didn't crash.</p>
+
+<script id="dummy"></script>
+
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var scriptElement;
+var scriptText = "var self = document.getElementById('script'); self.parentNode.removeChild(self);";
+
+/* appendChild */
+scriptElement = document.createElement("script");
+scriptElement.setAttribute("id", "script");
+scriptElement.appendChild(document.createTextNode(scriptText));
+document.body.appendChild(scriptElement);
+
+/* insertBefore */
+scriptElement = document.createElement("script");
+scriptElement.setAttribute("id", "script");
+scriptElement.appendChild(document.createTextNode(scriptText));
+document.body.insertBefore(scriptElement, document.getElementById("dummy"));
+
+/* replaceChild */
+scriptElement = document.createElement("script");
+scriptElement.setAttribute("id", "script");
+scriptElement.appendChild(document.createTextNode(scriptText));
+document.body.replaceChild(scriptElement, document.getElementById("dummy"));
+</script>
+
+<script id="script">
+/* parser insertion */
+eval(scriptText);
+</script>
+
+</body>
index ce8ac5f5ba2e84b8af0dada8a7c233608b591744..0f8b91d2bceb7b737cd36088f34badc17264d5cf 100644 (file)
         * rendering/RenderReplaced.cpp:
         (WebCore::RenderReplaced::selectionRect):
 
+2007-03-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed <rdar://problem/5088234> REGRESSION: Crash occurs at WebCore::Node::
+        createRendererIfNeeded() when changing map views with MS Virtual Earth 
+        (http://www.ziprealty.com/)
+        
+        The cause of the crash was the insertion of a <script> element whose
+        script removed it from the document. The <script> element would then be 
+        garbage when the insertion routine went on to attach() it.
+        
+        The solution here is to check that an element is still your child before
+        trying to attach() it. This matches the style of checks we do elsewhere
+        in the node insertion and removal code.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::appendChild):
+
 2007-03-26  Geoffrey Garen  <ggaren@apple.com>
 
         Removed now-stale #includes of <assert.h>.
index c6db06e61ebad14a474a8f4fca8bbf55e8a09369..846ddbef76bb706cc6db9c51f53775214b6d9d49 100644 (file)
@@ -209,7 +209,7 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         dispatchChildInsertionEvents(child.get(), ec);
                 
         // Add child to the rendering tree.
-        if (attached() && !child->attached())
+        if (attached() && !child->attached() && child->parent() == this)
             child->attach();
 
         child = nextChild.release();
@@ -313,7 +313,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         dispatchChildInsertionEvents(child.get(), ec);
                 
         // Add child to the rendering tree
-        if (attached() && !child->attached())
+        if (attached() && !child->attached() && child->parent() == this)
             child->attach();
 
         prev = child;
@@ -531,10 +531,9 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec)
 
         // Dispatch the mutation events
         dispatchChildInsertionEvents(child.get(), ec);
-                
+
         // Add child to the rendering tree
-        // ### should we detach() it first if it's already attached?
-        if (attached() && !child->attached())
+        if (attached() && !child->attached() && child->parent() == this)
             child->attach();
         
         child = nextChild.release();