Attachment 358894 Details for Bug 193351 – patch

[patch] patch

imagemap-scope.patch (text/plain), 3.78 KB, created by Antti Koivisto on 2019-01-11 07:22:01 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Antti Koivisto

Created: 2019-01-11 07:22:01 PST

Size: 3.78 KB

patch

obsolete

>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 239862)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,23 @@
>+2019-01-11  Antti Koivisto  <antti@apple.com>
>+
>+        Release assert when removing element with a map element in the shadow tree
>+        https://bugs.webkit.org/show_bug.cgi?id=193351
>+        <rdar://problem/47208807>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        When a shadow host that has a map element in the shadow tree is removed from the document, we try
>+        to remove the map from the scope of the host.
>+
>+        Test: fast/shadow-dom/image-map-tree-scope.html
>+
>+        * html/HTMLMapElement.cpp:
>+        (WebCore::HTMLMapElement::insertedIntoAncestor):
>+        (WebCore::HTMLMapElement::removedFromAncestor):
>+
>+        Add and remove image maps when the scope changes, not when the document changes.
>+        This matches how id/name/etc updates work in the HTMLElement.
>+
> 2019-01-10  Myles C. Maxfield  <mmaxfield@apple.com>
> 
>         [WHLSL] Include the standard library
>Index: Source/WebCore/html/HTMLMapElement.cpp
>===================================================================
>--- Source/WebCore/html/HTMLMapElement.cpp	(revision 239826)
>+++ Source/WebCore/html/HTMLMapElement.cpp	(working copy)
>@@ -118,14 +118,14 @@ Ref<HTMLCollection> HTMLMapElement::area
> Node::InsertedIntoAncestorResult HTMLMapElement::insertedIntoAncestor(InsertionType insertionType, ContainerNode& parentOfInsertedTree)
> {
>     Node::InsertedIntoAncestorResult request = HTMLElement::insertedIntoAncestor(insertionType, parentOfInsertedTree);
>-    if (insertionType.connectedToDocument)
>+    if (insertionType.treeScopeChanged)
>         treeScope().addImageMap(*this);
>     return request;
> }
> 
> void HTMLMapElement::removedFromAncestor(RemovalType removalType, ContainerNode& oldParentOfRemovedTree)
> {
>-    if (removalType.disconnectedFromDocument)
>+    if (removalType.treeScopeChanged)
>         oldParentOfRemovedTree.treeScope().removeImageMap(*this);
>     HTMLElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
> }
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 239826)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,14 @@
>+2019-01-11  Antti Koivisto  <antti@apple.com>
>+
>+        Release assert when removing element with a map element in the shadow tree
>+        https://bugs.webkit.org/show_bug.cgi?id=193351
>+        <rdar://problem/47208807>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * fast/shadow-dom/image-map-tree-scope-expected.txt: Added.
>+        * fast/shadow-dom/image-map-tree-scope.html: Added.
>+
> 2019-01-10  Dominik Infuehr  <dinfuehr@igalia.com>
> 
>         Enable DFG on ARM/Linux again
>Index: LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt
>===================================================================
>--- LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt	(nonexistent)
>+++ LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt	(working copy)
>@@ -0,0 +1 @@
>+This test passes if it doesn't crash.
>Index: LayoutTests/fast/shadow-dom/image-map-tree-scope.html
>===================================================================
>--- LayoutTests/fast/shadow-dom/image-map-tree-scope.html	(nonexistent)
>+++ LayoutTests/fast/shadow-dom/image-map-tree-scope.html	(working copy)
>@@ -0,0 +1,19 @@
>+<html>
>+<head>
>+<script>
>+if (window.testRunner)
>+    testRunner.dumpAsText();
>+
>+function test() {
>+    var shadow = host.attachShadow({mode: "open"});
>+    shadow.innerHTML = '<map name="bar">';
>+    host.remove();
>+}
>+</script>
>+</head>
>+<body onload="test()">
>+This test passes if it doesn't crash.
>+<map id="map" name="foo"></map>
>+<div id="host"></div>
>+</body>
>+</html>

Actions: View | Formatted Diff | Diff

Attachments on bug 193351: 358894