• rwlbuis@webkit.org's avatar
    REGRESSION: Assertion failure !collection->hasExactlyOneItem() in WebCore::namedItemGetter · f02f5da6
    rwlbuis@webkit.org authored
    https://bugs.webkit.org/show_bug.cgi?id=118056
    
    Reviewed by Ryosuke Niwa.
    
    Source/WebCore:
    
    The assert is hit in Debug mode because the DocumentOrderedMap in HTMLDocument::m_windowNamedItem
    includes matched SVG elements, but the WindowNameCollection used to collect the elements does not.
    This means the HTMLCollection stripped of SVG elements could end up hitting the empty or single item
    assertion, which the testcase verifies.
    To fix this change WindowNameCollection to include both SVG and HTML elements so it matches DocumentOrderedMap.
    
    Tests: svg/custom/document-all-includes-svg.html
           svg/custom/window-named-item-lookup.html
    
    * html/HTMLCollection.cpp:
    (WebCore::isMatchingElement):
    (WebCore::HTMLCollection::updateNameCache):
    
    LayoutTests:
    
    Add test to verify that SVG and HTML elements with id's are both found when using document.all or named properties.
    
    * svg/custom/document-all-includes-svg-expected.txt: Added.
    * svg/custom/document-all-includes-svg.html: Added.
    * svg/custom/window-named-item-lookup-expected.txt: Added.
    * svg/custom/window-named-item-lookup.html: Added.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154441 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    f02f5da6
ChangeLog 1.73 MB
The source could not be displayed because it is larger than 1 MB. You can load it anyway or download it instead.