Commit f02f5da6 authored by rwlbuis@webkit.org's avatar rwlbuis@webkit.org
Browse files

REGRESSION: Assertion failure !collection->hasExactlyOneItem() in WebCore::namedItemGetter

https://bugs.webkit.org/show_bug.cgi?id=118056

Reviewed by Ryosuke Niwa.

Source/WebCore:

The assert is hit in Debug mode because the DocumentOrderedMap in HTMLDocument::m_windowNamedItem
includes matched SVG elements, but the WindowNameCollection used to collect the elements does not.
This means the HTMLCollection stripped of SVG elements could end up hitting the empty or single item
assertion, which the testcase verifies.
To fix this change WindowNameCollection to include both SVG and HTML elements so it matches DocumentOrderedMap.

Tests: svg/custom/document-all-includes-svg.html
       svg/custom/window-named-item-lookup.html

* html/HTMLCollection.cpp:
(WebCore::isMatchingElement):
(WebCore::HTMLCollection::updateNameCache):

LayoutTests:

Add test to verify that SVG and HTML elements with id's are both found when using document.all or named properties.

* svg/custom/document-all-includes-svg-expected.txt: Added.
* svg/custom/document-all-includes-svg.html: Added.
* svg/custom/window-named-item-lookup-expected.txt: Added.
* svg/custom/window-named-item-lookup.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154441 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent da36125d
2013-08-22 Rob Buis <rwlbuis@webkit.org>
REGRESSION: Assertion failure !collection->hasExactlyOneItem() in WebCore::namedItemGetter
https://bugs.webkit.org/show_bug.cgi?id=118056
Reviewed by Ryosuke Niwa.
Add test to verify that SVG and HTML elements with id's are both found when using document.all or named properties.
* svg/custom/document-all-includes-svg-expected.txt: Added.
* svg/custom/document-all-includes-svg.html: Added.
* svg/custom/window-named-item-lookup-expected.txt: Added.
* svg/custom/window-named-item-lookup.html: Added.
2013-08-22 Renata Hodovan <reni@webkit.org>
 
ASSERTION FAILED: extractedStyle in WebCore::ApplyStyleCommand::removeInlineStyleFromElement
PASS successfullyParsed is true
TEST COMPLETE
PASS document.all['test1'].length is 2
PASS document.all['test2'].length is 2
PASS document.all['test3'].nodeName is "A"
PASS document.all['test4'].length is 2
PASS document.all['test5'].length is 2
<!DOCTYPE html>
<html>
<head>
<script src="../../fast/js/resources/js-test-pre.js"></script>
<script>
function runTest()
{
shouldBe("document.all['test1'].length", "2");
shouldBe("document.all['test2'].length", "2");
shouldBeEqualToString("document.all['test3'].nodeName", 'A');
shouldBe("document.all['test4'].length", "2");
shouldBe("document.all['test5'].length", "2");
}
</script>
<script src="../../fast/js/resources/js-test-post.js"></script>
</head>
<body onload="runTest()">
<a id="test1"></a>
<svg id="test1"/>
<svg id="test2"/>
<a id="test2"></a>
<a id="test3"></a>
<a id="test4"></a>
<div id="test4"></div>
<svg id="test5"></svg>
<svg id="test5"></svg>
</body>
</html>
PASS successfullyParsed is true
TEST COMPLETE
PASS window.test1.length is 2
PASS window.test2.length is 2
PASS window.test3.nodeName is "A"
PASS window.test4.length is 2
PASS window.test5.length is 2
<!DOCTYPE html>
<html>
<head>
<script src="../../fast/js/resources/js-test-pre.js"></script>
<script>
function runTest()
{
shouldBe("window.test1.length", "2");
shouldBe("window.test2.length", "2");
shouldBeEqualToString("window.test3.nodeName", 'A');
shouldBe("window.test4.length", "2");
shouldBe("window.test5.length", "2");
}
</script>
<script src="../../fast/js/resources/js-test-post.js"></script>
</head>
<body onload="runTest()">
<a id="test1"></a>
<svg id="test1"/>
<svg id="test2"/>
<a id="test2"></a>
<a id="test3"></a>
<a id="test4"></a>
<div id="test4"></div>
<svg id="test5"></svg>
<svg id="test5"></svg>
</body>
</html>
2013-08-22 Rob Buis <rwlbuis@webkit.org>
REGRESSION: Assertion failure !collection->hasExactlyOneItem() in WebCore::namedItemGetter
https://bugs.webkit.org/show_bug.cgi?id=118056
Reviewed by Ryosuke Niwa.
The assert is hit in Debug mode because the DocumentOrderedMap in HTMLDocument::m_windowNamedItem
includes matched SVG elements, but the WindowNameCollection used to collect the elements does not.
This means the HTMLCollection stripped of SVG elements could end up hitting the empty or single item
assertion, which the testcase verifies.
To fix this change WindowNameCollection to include both SVG and HTML elements so it matches DocumentOrderedMap.
Tests: svg/custom/document-all-includes-svg.html
svg/custom/window-named-item-lookup.html
* html/HTMLCollection.cpp:
(WebCore::isMatchingElement):
(WebCore::HTMLCollection::updateNameCache):
2013-08-22 Gyuyoung Kim <gyuyoung.kim@samsung.com>
 
Introduce toSVGRadialGradientElement(), and use it
......@@ -182,7 +182,7 @@ inline bool isMatchingElement(const NodeListType*, Element*);
template <> inline bool isMatchingElement(const HTMLCollection* htmlCollection, Element* element)
{
CollectionType type = htmlCollection->type();
if (!element->isHTMLElement() && !(type == DocAll || type == NodeChildren))
if (!element->isHTMLElement() && !(type == DocAll || type == NodeChildren || type == WindowNamedItems))
return false;
switch (type) {
......@@ -627,15 +627,14 @@ void HTMLCollection::updateNameCache() const
unsigned arrayOffset = 0;
for (Element* element = traverseFirstElement(arrayOffset, root); element; element = traverseNextElement(arrayOffset, element, root)) {
const AtomicString& idAttrVal = element->getIdAttribute();
if (!idAttrVal.isEmpty())
appendIdCache(idAttrVal, element);
if (!element->isHTMLElement())
continue;
HTMLElement* htmlElement = toHTMLElement(element);
const AtomicString& idAttrVal = htmlElement->getIdAttribute();
const AtomicString& nameAttrVal = htmlElement->getNameAttribute();
if (!idAttrVal.isEmpty())
appendIdCache(idAttrVal, htmlElement);
if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal && (type() != DocAll || nameShouldBeVisibleInDocumentAll(htmlElement)))
appendNameCache(nameAttrVal, htmlElement);
const AtomicString& nameAttrVal = element->getNameAttribute();
if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal && (type() != DocAll || nameShouldBeVisibleInDocumentAll(toHTMLElement(element))))
appendNameCache(nameAttrVal, element);
}
setHasNameCache();
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment