Changeset 214808 in webkit


Ignore:
Timestamp:
Apr 3, 2017 10:09:21 AM (7 years ago)
Author:
Carlos Garcia Campos
Message:

Merge r214510 - Only attach Attributes to a given element one time
​https://bugs.webkit.org/show_bug.cgi?id=170125
<rdar://problem/31279676>

Reviewed by Chris Dumez.

Source/WebCore:

Attach the attribute node to the Element before calling 'setAttributeInternal', since that method may cause
arbitrary JavaScript events to fire.

Test: fast/dom/Attr/only-attach-attr-once.html

  • dom/Element.cpp:

(WebCore::Element::attachAttributeNodeIfNeeded): Added.
(WebCore::Element::setAttributeNode): Use new method. Revise to attach attribute before calling 'setAttributeInternal'.
(WebCore::Element::setAttributeNodeNS): Ditto.

  • dom/Element.h:

LayoutTests:

  • fast/dom/Attr/make-unique-element-data-while-replacing-attr-expected.txt: Rebaselined.
  • fast/dom/Attr/make-unique-element-data-while-replacing-attr.html: Add check before setting new value.
  • fast/dom/Attr/only-attach-attr-once-expected.txt: Added.
  • fast/dom/Attr/only-attach-attr-once.html: Added.
Location:
releases/WebKitGTK/webkit-2.16
Files:
2 added
6 edited

Legend:

Unmodified
Added
Removed

  • releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog

    r214804 r214808  
     12017-03-27  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Only attach Attributes to a given element one time
     4        https://bugs.webkit.org/show_bug.cgi?id=170125
     5        <rdar://problem/31279676>
     6
     7        Reviewed by Chris Dumez.
     8
     9        * fast/dom/Attr/make-unique-element-data-while-replacing-attr-expected.txt: Rebaselined.
     10        * fast/dom/Attr/make-unique-element-data-while-replacing-attr.html: Add check before setting new value.
     11        * fast/dom/Attr/only-attach-attr-once-expected.txt: Added.
     12        * fast/dom/Attr/only-attach-attr-once.html: Added.
     13
    1142017-03-28  Antti Koivisto  <antti@apple.com>
    215

  • releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/Attr/make-unique-element-data-while-replacing-attr-expected.txt

    r212214 r214808  
    44
    55
     6PASS element.getAttribute("width") is "a"
    67PASS element.getAttribute("width") is "b"
    78PASS successfullyParsed is true

  • releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/Attr/make-unique-element-data-while-replacing-attr.html

    r212214 r214808  
    1414element.setAttributeNode(oldAttr);
    1515
     16shouldBeEqualToString('element.getAttribute("width")', 'a');
     17
    1618element.addEventListener('DOMSubtreeModified', () => { element.cloneNode(); }, true);
    1719

  • releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog

    r214804 r214808  
     12017-03-27  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Only attach Attributes to a given element one time
     4        https://bugs.webkit.org/show_bug.cgi?id=170125
     5        <rdar://problem/31279676>
     6
     7        Reviewed by Chris Dumez.
     8
     9        Attach the attribute node to the Element before calling 'setAttributeInternal', since that method may cause
     10        arbitrary JavaScript events to fire.
     11
     12        Test: fast/dom/Attr/only-attach-attr-once.html
     13
     14        * dom/Element.cpp:
     15        (WebCore::Element::attachAttributeNodeIfNeeded): Added.
     16        (WebCore::Element::setAttributeNode): Use new method. Revise to attach attribute before calling 'setAttributeInternal'.
     17        (WebCore::Element::setAttributeNodeNS): Ditto.
     18        * dom/Element.h:
     19
    1202017-03-28  Antti Koivisto  <antti@apple.com>
    221

  • releases/WebKitGTK/webkit-2.16/Source/WebCore/dom/Element.cpp

    r214788 r214808  
    21222122}
    21232123
     2124void Element::attachAttributeNodeIfNeeded(Attr& attrNode)
     2125{
     2126    ASSERT(!attrNode.ownerElement() || attrNode.ownerElement() == this);
     2127    if (attrNode.ownerElement() == this)
     2128        return;
     2129
     2130    NoEventDispatchAssertion assertNoEventDispatch;
     2131
     2132    attrNode.attachToElement(*this);
     2133    treeScope().adoptIfNeeded(attrNode);
     2134    ensureAttrNodeListForElement(*this).append(&attrNode);
     2135}
     2136
    21242137ExceptionOr<RefPtr<Attr>> Element::setAttributeNode(Attr& attrNode)
    21252138{
    … …  
    21332146        return Exception { INUSE_ATTRIBUTE_ERR };
    21342147
     2148    {
     2149    NoEventDispatchAssertion assertNoEventDispatch;
    21352150    synchronizeAllAttributes();
     2151    }
     2152
    21362153    auto& elementData = ensureUniqueElementData();
    21372154
    21382155    auto existingAttributeIndex = elementData.findAttributeIndexByName(attrNode.localName(), shouldIgnoreAttributeCase(*this));
    2139     if (existingAttributeIndex == ElementData::attributeNotFound)
    2140         setAttributeInternal(elementData.findAttributeIndexByName(attrNode.qualifiedName()), attrNode.qualifiedName(), attrNode.value(), NotInSynchronizationOfLazyAttribute);
    2141     else {
     2156
     2157    // Attr::value() will return its 'm_standaloneValue' member any time its Element is set to nullptr. We need to cache this value
     2158    // before making changes to attrNode's Element connections.
     2159    auto attrNodeValue = attrNode.value();
     2160
     2161    if (existingAttributeIndex == ElementData::attributeNotFound) {
     2162        attachAttributeNodeIfNeeded(attrNode);
     2163        setAttributeInternal(elementData.findAttributeIndexByName(attrNode.qualifiedName()), attrNode.qualifiedName(), attrNodeValue, NotInSynchronizationOfLazyAttribute);
     2164    } else {
    21422165        const Attribute& attribute = attributeAt(existingAttributeIndex);
    21432166        if (oldAttrNode)
    … …  
    21462169            oldAttrNode = Attr::create(document(), attrNode.qualifiedName(), attribute.value());
    21472170
     2171        attachAttributeNodeIfNeeded(attrNode);
     2172
    21482173        if (attribute.name().matches(attrNode.qualifiedName()))
    2149             setAttributeInternal(existingAttributeIndex, attrNode.qualifiedName(), attrNode.value(), NotInSynchronizationOfLazyAttribute);
     2174            setAttributeInternal(existingAttributeIndex, attrNode.qualifiedName(), attrNodeValue, NotInSynchronizationOfLazyAttribute);
    21502175        else {
    21512176            removeAttributeInternal(existingAttributeIndex, NotInSynchronizationOfLazyAttribute);
    2152             setAttributeInternal(ensureUniqueElementData().findAttributeIndexByName(attrNode.qualifiedName()), attrNode.qualifiedName(), attrNode.value(), NotInSynchronizationOfLazyAttribute);
     2177            setAttributeInternal(ensureUniqueElementData().findAttributeIndexByName(attrNode.qualifiedName()), attrNode.qualifiedName(), attrNodeValue, NotInSynchronizationOfLazyAttribute);
    21532178        }
    21542179    }
    2155     if (attrNode.ownerElement() != this) {
    2156         attrNode.attachToElement(*this);
    2157         treeScope().adoptIfNeeded(attrNode);
    2158         ensureAttrNodeListForElement(*this).append(&attrNode);
    2159     }
     2180
    21602181    return WTFMove(oldAttrNode);
    21612182}
    … …  
    21722193        return Exception { INUSE_ATTRIBUTE_ERR };
    21732194
     2195    unsigned index = 0;
     2196   
     2197    // Attr::value() will return its 'm_standaloneValue' member any time its Element is set to nullptr. We need to cache this value
     2198    // before making changes to attrNode's Element connections.
     2199    auto attrNodeValue = attrNode.value();
     2200
     2201    {
     2202    NoEventDispatchAssertion assertNoEventDispatch;
    21742203    synchronizeAllAttributes();
    21752204    auto& elementData = ensureUniqueElementData();
    21762205
    2177     auto index = elementData.findAttributeIndexByName(attrNode.qualifiedName());
     2206    index = elementData.findAttributeIndexByName(attrNode.qualifiedName());
     2207
    21782208    if (index != ElementData::attributeNotFound) {
    21792209        if (oldAttrNode)
    … …  
    21822212            oldAttrNode = Attr::create(document(), attrNode.qualifiedName(), elementData.attributeAt(index).value());
    21832213    }
    2184 
    2185     setAttributeInternal(index, attrNode.qualifiedName(), attrNode.value(), NotInSynchronizationOfLazyAttribute);
    2186 
    2187     attrNode.attachToElement(*this);
    2188     treeScope().adoptIfNeeded(attrNode);
    2189     ensureAttrNodeListForElement(*this).append(&attrNode);
     2214    }
     2215
     2216    attachAttributeNodeIfNeeded(attrNode);
     2217    setAttributeInternal(index, attrNode.qualifiedName(), attrNodeValue, NotInSynchronizationOfLazyAttribute);
    21902218
    21912219    return WTFMove(oldAttrNode);

  • releases/WebKitGTK/webkit-2.16/Source/WebCore/dom/Element.h

    r214788 r214808  
    44 *           (C) 2001 Peter Kelly (pmk@post.com)
    55 *           (C) 2001 Dirk Mueller (mueller@kde.org)
    6  * Copyright (C) 2003-2016 Apple Inc. All rights reserved.
     6 * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
    77 *
    88 * This library is free software; you can redistribute it and/or
    … …  
    680680    // Anyone thinking of using this should call document instead of ownerDocument.
    681681    void ownerDocument() const = delete;
     682   
     683    void attachAttributeNodeIfNeeded(Attr&);
    682684
    683685    QualifiedName m_tagName;
Note: See TracChangeset for help on using the changeset viewer.