Skip to content
  • rwlbuis@webkit.org's avatar
    REGRESSION: Assertion failure !collection->hasExactlyOneItem() in WebCore::namedItemGetter · f02f5da6
    rwlbuis@webkit.org authored
    https://bugs.webkit.org/show_bug.cgi?id=118056
    
    Reviewed by Ryosuke Niwa.
    
    Source/WebCore:
    
    The assert is hit in Debug mode because the DocumentOrderedMap in HTMLDocument::m_windowNamedItem
    includes matched SVG elements, but the WindowNameCollection used to collect the elements does not.
    This means the HTMLCollection stripped of SVG elements could end up hitting the empty or single item
    assertion, which the testcase verifies.
    To fix this change WindowNameCollection to include both SVG and HTML elements so it matches DocumentOrderedMap.
    
    Tests: svg/custom/document-all-includes-svg.html
           svg/custom/window-named-item-lookup.html
    
    * html/HTMLCollection.cpp:
    (WebCore::isMatchingElement):
    (WebCore::HTMLCollection::updateNameCache):
    
    LayoutTests:
    
    Add test to verify that SVG and HTML elements with id's are both found when using document.all or named properties.
    
    * svg/custom/document-all-includes-svg-expected.txt: Added.
    * svg/custom/document-all-includes-svg.html: Added.
    * svg/custom/window-named-item-lookup-expected.txt: Added.
    * svg/custom/window-named-item-lookup.html: Added.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154441 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    f02f5da6
ChangeLog 1.73 MiB