Commit f6525067 authored by antti@apple.com's avatar antti@apple.com

REGRESSION (r158774): Iteration over element children is broken

https://bugs.webkit.org/show_bug.cgi?id=124145

Source/WebCore: 

Reviewed by Anders Carlsson.
        
Mutation during traversal invalidates the position cache. After the mid-point we start
traversing backwards as it the shortest path. However backward traversal of children-only
HTMLCollection was wrong and would end up going to descendants.
        
Reduction by yannick.poirier@inverto.tv.

Test: fast/dom/htmlcollection-children-mutation.html

* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::collectionTraverseBackward):
        
    Traverse direct children only when m_shouldOnlyIncludeDirectChildren bit is set.

LayoutTests: 

Reviewed by Anders Carlsson.

* fast/dom/htmlcollection-children-mutation-expected.txt: Added.
* fast/dom/htmlcollection-children-mutation.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159389 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent d647d51d
2013-11-17 Antti Koivisto <antti@apple.com>
REGRESSION (r158774): Iteration over element children is broken
https://bugs.webkit.org/show_bug.cgi?id=124145
Reviewed by Anders Carlsson.
* fast/dom/htmlcollection-children-mutation-expected.txt: Added.
* fast/dom/htmlcollection-children-mutation.html: Added.
2013-11-17 Antti Koivisto <antti@apple.com>
Simple line path does not respect visibility:hidden
......
Test traversing children using HTMLCollection while mutating DOM
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS child.firstChild.innerText is "child 0"
PASS child.firstChild.innerText is "child 1"
PASS child.firstChild.innerText is "child 2"
PASS child.firstChild.innerText is "child 3"
PASS child.firstChild.innerText is "child 4"
PASS child is null
PASS successfullyParsed is true
TEST COMPLETE
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<script src="../../resources/js-test-pre.js"></script>
</head>
<body>
<div id="test" style="display:none">
<div><span></span></div>
<div><span></span></div>
<div><span></span></div>
<div><span></span></div>
<div><span></span></div>
</div>
<script>
description("Test traversing children using HTMLCollection while mutating DOM");
try {
var test = document.getElementById("test");
for (var i = 0; i < test.children.length; i++)
test.children[i].firstChild.innerHTML = "child " + i;
} catch(e) {}
var child = test.firstElementChild;
for (var i = 0; i < 5; i++) {
shouldBeEqualToString("child.firstChild.innerText", "child " + i);
child = child.nextElementSibling;
}
shouldBeNull("child");
</script>
<script src="../../resources/js-test-post.js"></script>
</body>
</html>
2013-11-17 Antti Koivisto <antti@apple.com>
REGRESSION (r158774): Iteration over element children is broken
https://bugs.webkit.org/show_bug.cgi?id=124145
Reviewed by Anders Carlsson.
Mutation during traversal invalidates the position cache. After the mid-point we start
traversing backwards as it the shortest path. However backward traversal of children-only
HTMLCollection was wrong and would end up going to descendants.
Reduction by yannick.poirier@inverto.tv.
Test: fast/dom/htmlcollection-children-mutation.html
* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::collectionTraverseBackward):
Traverse direct children only when m_shouldOnlyIncludeDirectChildren bit is set.
2013-11-17 Zoltan Horvath <zoltan@webkit.org>
Move LineLayoutState.h into rendering/line
......
......@@ -354,6 +354,11 @@ Element* HTMLCollection::collectionTraverseBackward(Element& current, unsigned c
// FIXME: This should be optimized similarly to the forward case.
auto& root = rootNode();
Element* element = &current;
if (m_shouldOnlyIncludeDirectChildren) {
for (; count && element ; --count)
element = iterateForPreviousElement(ElementTraversal::previousSibling(element));
return element;
}
for (; count && element ; --count)
element = iterateForPreviousElement(ElementTraversal::previous(element, &root));
return element;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment