nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/fast/dom/insert-child-with-mutation-...

14 lines
524 B
Plaintext
Raw Permalink Normal View History

Reparenting during a mutation event inside appendChild could result in a circular DOM tree https://bugs.webkit.org/show_bug.cgi?id=192825 Reviewed by Zalan Bujtas. Source/WebCore: The bug was caused by appendChildWithoutPreInsertionValidityCheck, insertBefore and replaceChild checking the circular dependency against newChild instead of targets even though when newChild is a document fragment, appendChildWithoutPreInsertionValidityCheck inserts the children of the document fragment. Fixed the bug by checking the circular dependency against each target child. Also fixed the bug that checkAcceptChildGuaranteedNodeTypes was not considering shadow inclusive ancestors or template host elements. Tests: fast/dom/append-child-with-mutation-event-removal-and-circular-insertion.html fast/dom/append-child-with-mutation-event-removal-and-circular-shadow-insertion.html fast/dom/append-child-with-mutation-event-removal-and-circular-template-insertion.html fast/dom/insert-child-with-mutation-event-removal-and-circular-insertion.html fast/dom/insert-child-with-mutation-event-removal-and-circular-shadow-insertion.html fast/dom/insert-child-with-mutation-event-removal-and-circular-template-insertion.html fast/dom/replace-child-with-mutation-event-removal-and-circular-insertion.html fast/dom/replace-child-with-mutation-event-removal-and-circular-shadow-insertion.html fast/dom/replace-child-with-mutation-event-removal-and-circular-template-insertion.html * dom/ContainerNode.cpp: (WebCore::checkAcceptChildGuaranteedNodeTypes): (WebCore::ContainerNode::insertBefore): (WebCore::ContainerNode::replaceChild): (WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck): LayoutTests: Added regression tests. * fast/dom/append-child-with-mutation-event-removal-and-circular-insertion-expected.txt: Added. * fast/dom/append-child-with-mutation-event-removal-and-circular-insertion.html: Added. * fast/dom/append-child-with-mutation-event-removal-and-circular-shadow-insertion-expected.txt: Added. * fast/dom/append-child-with-mutation-event-removal-and-circular-shadow-insertion.html: Added. * fast/dom/append-child-with-mutation-event-removal-and-circular-template-insertion-expected.txt: Added. * fast/dom/append-child-with-mutation-event-removal-and-circular-template-insertion.html: Added. * fast/dom/insert-child-with-mutation-event-removal-and-circular-insertion-expected.txt: Added. * fast/dom/insert-child-with-mutation-event-removal-and-circular-insertion.html: Added. * fast/dom/insert-child-with-mutation-event-removal-and-circular-shadow-insertion-expected.txt: Added. * fast/dom/insert-child-with-mutation-event-removal-and-circular-shadow-insertion.html: Added. * fast/dom/insert-child-with-mutation-event-removal-and-circular-template-insertion-expected.txt: Added. * fast/dom/insert-child-with-mutation-event-removal-and-circular-template-insertion.html: Added. * fast/dom/replace-child-with-mutation-event-removal-and-circular-insertion-expected.txt: Added. * fast/dom/replace-child-with-mutation-event-removal-and-circular-insertion.html: Added. * fast/dom/replace-child-with-mutation-event-removal-and-circular-shadow-insertion-expected.txt: Added. * fast/dom/replace-child-with-mutation-event-removal-and-circular-shadow-insertion.html: Added. * fast/dom/replace-child-with-mutation-event-removal-and-circular-template-insertion-expected.txt: Added. * fast/dom/replace-child-with-mutation-event-removal-and-circular-template-insertion.html: Added. Canonical link: https://commits.webkit.org/210243@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243175 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2019-03-19 22:25:44 +00:00
This tests re-parenting a child of the document fragment during an insertion so as to create a circular node tree.
WebKit should detect this case and throw HierarchyRequestError.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS container.insertBefore(fragment, refChild) threw exception HierarchyRequestError: The operation would yield an incorrect node tree..
PASS container.parentNode is child.content
PASS child.parentNode is null
PASS successfullyParsed is true
TEST COMPLETE