Attachment 347244 Details for Bug 188634 – Fixes the bug

[patch] Fixes the bug

bug-188634-20180815215250.patch (text/plain), 6.33 KB, created by Ryosuke Niwa on 2018-08-15 21:52:51 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Ryosuke Niwa

Created: 2018-08-15 21:52:51 PDT

Size: 6.33 KB

patch

obsolete

>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 234910)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,26 @@
>+2018-08-15  Ryosuke Niwa  <rniwa@webkit.org>
>+
>+        Custom element constructor doesn't use HTMLElement in new.target's realm
>+        https://bugs.webkit.org/show_bug.cgi?id=188634
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Fixed the bug that HTMLElement's constructor was constructing an element of its own realm
>+        instead of the realm of new.target. This results in the JS wrapper created for the element
>+        belonging to the global object of the HTMLElement constructor which was invoked instead of
>+        the global object of new.target as specified in:
>+        https://html.spec.whatwg.org/multipage/dom.html#html-element-constructors
>+
>+	In particular, step 9.2. specifies that we "perform element.[[SetPrototypeOf]](prototype)."
>+        where prototype is the result of Get(NewTarget, "prototype") in step 7.
>+
>+        WebKit's new behavior matches that of Chrome and Firefox.
>+
>+        Test: imported/w3c/web-platform-tests/custom-elements/htmlconstructor/newtarget.html
>+
>+        * bindings/js/JSHTMLElementCustom.cpp:
>+        (WebCore::constructJSHTMLElement): 
>+
> 2018-08-15  Ben Richards  <benton_richards@apple.com>
> 
>         We should cache the compiled sandbox profile in a data vault
>Index: Source/WebCore/bindings/js/JSHTMLElementCustom.cpp
>===================================================================
>--- Source/WebCore/bindings/js/JSHTMLElementCustom.cpp	(revision 234910)
>+++ Source/WebCore/bindings/js/JSHTMLElementCustom.cpp	(working copy)
>@@ -55,7 +55,8 @@ EncodedJSValue JSC_HOST_CALL constructJS
>     ASSERT(context->isDocument());
> 
>     JSValue newTargetValue = exec.thisValue();
>-    auto* globalObject = jsConstructor->globalObject();
>+    auto* newTarget = newTargetValue.getObject();
>+    auto* globalObject = jsCast<JSDOMGlobalObject*>(newTarget->globalObject(vm));
>     JSValue htmlElementConstructorValue = JSHTMLElement::getConstructor(vm, globalObject);
>     if (newTargetValue == htmlElementConstructorValue)
>         return throwVMTypeError(&exec, scope, "new.target is not a valid custom element constructor"_s);
>@@ -70,7 +71,6 @@ EncodedJSValue JSC_HOST_CALL constructJS
>     if (!registry)
>         return throwVMTypeError(&exec, scope, "new.target is not a valid custom element constructor"_s);
> 
>-    JSObject* newTarget = newTargetValue.getObject();
>     auto* elementInterface = registry->findInterface(newTarget);
>     if (!elementInterface)
>         return throwVMTypeError(&exec, scope, "new.target does not define a custom element"_s);
>Index: LayoutTests/imported/w3c/ChangeLog
>===================================================================
>--- LayoutTests/imported/w3c/ChangeLog	(revision 234910)
>+++ LayoutTests/imported/w3c/ChangeLog	(working copy)
>@@ -1,3 +1,15 @@
>+2018-08-15  Ryosuke Niwa  <rniwa@webkit.org>
>+
>+        Custom element constructor doesn't use HTMLElement in new.target's realm
>+        https://bugs.webkit.org/show_bug.cgi?id=188634
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Rebaselined the test now that all relevant test cases pass. All remaining test failures are
>+        for customized builtin, which we do not and shall not implement.
>+
>+        * web-platform-tests/custom-elements/htmlconstructor/newtarget-expected.txt:
>+
> 2018-08-14  Ryosuke Niwa  <rniwa@webkit.org>
> 
>         connectedCallback is invoked by the HTML parser after child nodes had been inserted
>Index: LayoutTests/imported/w3c/web-platform-tests/custom-elements/htmlconstructor/newtarget-expected.txt
>===================================================================
>--- LayoutTests/imported/w3c/web-platform-tests/custom-elements/htmlconstructor/newtarget-expected.txt	(revision 234910)
>+++ LayoutTests/imported/w3c/web-platform-tests/custom-elements/htmlconstructor/newtarget-expected.txt	(working copy)
>@@ -1,10 +1,10 @@
> 
> PASS Use NewTarget's prototype, not the one stored at definition time 
> PASS Rethrow any exceptions thrown while getting the prototype 
>-FAIL If prototype is not object (null), derives the fallback from NewTarget's realm (autonomous custom elements) assert_equals: Must use the HTMLElement from the realm of NewTarget expected object "[object HTMLElementPrototype]" but got object "[object HTMLElementPrototype]"
>-FAIL If prototype is not object (undefined), derives the fallback from NewTarget's realm (autonomous custom elements) assert_equals: Must use the HTMLElement from the realm of NewTarget expected object "[object HTMLElementPrototype]" but got object "[object HTMLElementPrototype]"
>-FAIL If prototype is not object (5), derives the fallback from NewTarget's realm (autonomous custom elements) assert_equals: Must use the HTMLElement from the realm of NewTarget expected object "[object HTMLElementPrototype]" but got object "[object HTMLElementPrototype]"
>-FAIL If prototype is not object (string), derives the fallback from NewTarget's realm (autonomous custom elements) assert_equals: Must use the HTMLElement from the realm of NewTarget expected object "[object HTMLElementPrototype]" but got object "[object HTMLElementPrototype]"
>+PASS If prototype is not object (null), derives the fallback from NewTarget's realm (autonomous custom elements) 
>+PASS If prototype is not object (undefined), derives the fallback from NewTarget's realm (autonomous custom elements) 
>+PASS If prototype is not object (5), derives the fallback from NewTarget's realm (autonomous custom elements) 
>+PASS If prototype is not object (string), derives the fallback from NewTarget's realm (autonomous custom elements) 
> FAIL If prototype is not object (null), derives the fallback from NewTarget's realm (customized built-in elements) promise_test: Unhandled rejection with value: object "TypeError: Reflect.construct requires the first argument be a constructor"
> FAIL If prototype is not object (undefined), derives the fallback from NewTarget's realm (customized built-in elements) promise_test: Unhandled rejection with value: object "TypeError: Reflect.construct requires the first argument be a constructor"
> FAIL If prototype is not object (5), derives the fallback from NewTarget's realm (customized built-in elements) promise_test: Unhandled rejection with value: object "TypeError: Reflect.construct requires the first argument be a constructor"

Actions: View | Formatted Diff | Diff

Attachments on bug 188634: 347244 | 347245