WebKit Bugzilla
Attachment 358894 Details for
Bug 193351
: Release assert when removing element with a map element in the shadow tree
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
patch
imagemap-scope.patch (text/plain), 3.78 KB, created by
Antti Koivisto
on 2019-01-11 07:22:01 PST
(
hide
)
Description:
patch
Filename:
MIME Type:
Creator:
Antti Koivisto
Created:
2019-01-11 07:22:01 PST
Size:
3.78 KB
patch
obsolete
>Index: Source/WebCore/ChangeLog >=================================================================== >--- Source/WebCore/ChangeLog (revision 239862) >+++ Source/WebCore/ChangeLog (working copy) >@@ -1,3 +1,23 @@ >+2019-01-11 Antti Koivisto <antti@apple.com> >+ >+ Release assert when removing element with a map element in the shadow tree >+ https://bugs.webkit.org/show_bug.cgi?id=193351 >+ <rdar://problem/47208807> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ When a shadow host that has a map element in the shadow tree is removed from the document, we try >+ to remove the map from the scope of the host. >+ >+ Test: fast/shadow-dom/image-map-tree-scope.html >+ >+ * html/HTMLMapElement.cpp: >+ (WebCore::HTMLMapElement::insertedIntoAncestor): >+ (WebCore::HTMLMapElement::removedFromAncestor): >+ >+ Add and remove image maps when the scope changes, not when the document changes. >+ This matches how id/name/etc updates work in the HTMLElement. >+ > 2019-01-10 Myles C. Maxfield <mmaxfield@apple.com> > > [WHLSL] Include the standard library >Index: Source/WebCore/html/HTMLMapElement.cpp >=================================================================== >--- Source/WebCore/html/HTMLMapElement.cpp (revision 239826) >+++ Source/WebCore/html/HTMLMapElement.cpp (working copy) >@@ -118,14 +118,14 @@ Ref<HTMLCollection> HTMLMapElement::area > Node::InsertedIntoAncestorResult HTMLMapElement::insertedIntoAncestor(InsertionType insertionType, ContainerNode& parentOfInsertedTree) > { > Node::InsertedIntoAncestorResult request = HTMLElement::insertedIntoAncestor(insertionType, parentOfInsertedTree); >- if (insertionType.connectedToDocument) >+ if (insertionType.treeScopeChanged) > treeScope().addImageMap(*this); > return request; > } > > void HTMLMapElement::removedFromAncestor(RemovalType removalType, ContainerNode& oldParentOfRemovedTree) > { >- if (removalType.disconnectedFromDocument) >+ if (removalType.treeScopeChanged) > oldParentOfRemovedTree.treeScope().removeImageMap(*this); > HTMLElement::removedFromAncestor(removalType, oldParentOfRemovedTree); > } >Index: LayoutTests/ChangeLog >=================================================================== >--- LayoutTests/ChangeLog (revision 239826) >+++ LayoutTests/ChangeLog (working copy) >@@ -1,3 +1,14 @@ >+2019-01-11 Antti Koivisto <antti@apple.com> >+ >+ Release assert when removing element with a map element in the shadow tree >+ https://bugs.webkit.org/show_bug.cgi?id=193351 >+ <rdar://problem/47208807> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * fast/shadow-dom/image-map-tree-scope-expected.txt: Added. >+ * fast/shadow-dom/image-map-tree-scope.html: Added. >+ > 2019-01-10 Dominik Infuehr <dinfuehr@igalia.com> > > Enable DFG on ARM/Linux again >Index: LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt >=================================================================== >--- LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt (nonexistent) >+++ LayoutTests/fast/shadow-dom/image-map-tree-scope-expected.txt (working copy) >@@ -0,0 +1 @@ >+This test passes if it doesn't crash. >Index: LayoutTests/fast/shadow-dom/image-map-tree-scope.html >=================================================================== >--- LayoutTests/fast/shadow-dom/image-map-tree-scope.html (nonexistent) >+++ LayoutTests/fast/shadow-dom/image-map-tree-scope.html (working copy) >@@ -0,0 +1,19 @@ >+<html> >+<head> >+<script> >+if (window.testRunner) >+ testRunner.dumpAsText(); >+ >+function test() { >+ var shadow = host.attachShadow({mode: "open"}); >+ shadow.innerHTML = '<map name="bar">'; >+ host.remove(); >+} >+</script> >+</head> >+<body onload="test()"> >+This test passes if it doesn't crash. >+<map id="map" name="foo"></map> >+<div id="host"></div> >+</body> >+</html>
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 193351
: 358894