Changeset 189610 in webkit


Ignore:
Timestamp:
Sep 11, 2015, 12:01:44 AM (10 years ago)
Author:
bshafiei@apple.com
Message:

Merged r189469. rdar://problem/22316524

Location:
branches/safari-601-branch
Files:
11 edited
8 copied

Legend:

Unmodified
Added
Removed

  • branches/safari-601-branch/LayoutTests/ChangeLog

    r189574 r189610  
     12015-09-10  Babak Shafiei  <bshafiei@apple.com>
     2
     3        Merge r189469.
     4
     5    2015-09-07  Daniel Bates  <dabates@apple.com>
     6
     7            ASSERT_WITH_SECURITY_IMPLICATION in WebCore::DocumentOrderedMap::get(); update form
     8            association after subtree insertion
     9            https://bugs.webkit.org/show_bug.cgi?id=148919
     10            <rdar://problem/21868036>
     11
     12            Reviewed by Andy Estes.
     13
     14            Add tests to ensure that updating the form association of a form control in a subtree
     15            does not cause an assertion failure.
     16
     17            * fast/forms/update-form-owner-in-moved-subtree-assertion-failure-2-expected.txt: Added.
     18            * fast/forms/update-form-owner-in-moved-subtree-assertion-failure-2.html: Added.
     19            * fast/forms/update-form-owner-in-moved-subtree-assertion-failure-3-expected.txt: Added.
     20            * fast/forms/update-form-owner-in-moved-subtree-assertion-failure-3.html: Added.
     21            * fast/forms/update-form-owner-in-moved-subtree-assertion-failure-4-expected.txt: Added.
     22            * fast/forms/update-form-owner-in-moved-subtree-assertion-failure-4.html: Added.
     23            * fast/forms/update-form-owner-in-moved-subtree-assertion-failure-expected.txt: Added.
     24            * fast/forms/update-form-owner-in-moved-subtree-assertion-failure.html: Added.
     25
    1262015-09-10  Alexey Proskuryakov  <ap@apple.com>
    227

  • branches/safari-601-branch/Source/WebCore/ChangeLog

    r189320 r189610  
     12015-09-10  Babak Shafiei  <bshafiei@apple.com>
     2
     3        Merge r189469.
     4
     5    2015-09-07  Daniel Bates  <dabates@apple.com>
     6
     7            ASSERT_WITH_SECURITY_IMPLICATION in WebCore::DocumentOrderedMap::get(); update form
     8            association after subtree insertion
     9            https://bugs.webkit.org/show_bug.cgi?id=148919
     10            <rdar://problem/21868036>
     11
     12            Reviewed by Andy Estes.
     13
     14            Currently we update the form association of a form control upon insertion into
     15            the document. Instead we should update the form association of a form control
     16            after its containing subtree is inserted into the document to avoid an assertion
     17            failure when the containing subtree has an element whose id is identical to both
     18            the id of some other element in the document and the name of the form referenced
     19            by the inserted form control.
     20
     21            Tests: fast/forms/update-form-owner-in-moved-subtree-assertion-failure-2.html
     22                   fast/forms/update-form-owner-in-moved-subtree-assertion-failure-3.html
     23                   fast/forms/update-form-owner-in-moved-subtree-assertion-failure-4.html
     24                   fast/forms/update-form-owner-in-moved-subtree-assertion-failure.html
     25
     26            * html/FormAssociatedElement.cpp:
     27            (WebCore::FormAssociatedElement::insertedInto): Moved resetFormOwner() from here
     28            to {HTMLFormControlElement, HTMLObjectElement}::finishedInsertingSubtree().
     29            * html/HTMLFormControlElement.cpp:
     30            (WebCore::HTMLFormControlElement::insertedInto): Return InsertionShouldCallFinishedInsertingSubtree
     31            so that HTMLFormControlElement::finishedInsertingSubtree() is called.
     32            (WebCore::HTMLFormControlElement::finishedInsertingSubtree): Added; turn around and
     33            call FormAssociatedElement::resetFormOwner().
     34            * html/HTMLFormControlElement.h:
     35            * html/HTMLInputElement.cpp:
     36            (WebCore::HTMLInputElement::insertedInto): Return InsertionShouldCallFinishedInsertingSubtree so
     37            that HTMLInputElement::finishedInsertingSubtree() is called and move logic to update radio button
     38            group from here...
     39            (WebCore::HTMLInputElement::finishedInsertingSubtree): to here.
     40            * html/HTMLInputElement.h:
     41            * html/HTMLObjectElement.cpp:
     42            (WebCore::HTMLObjectElement::insertedInto): Return InsertionShouldCallFinishedInsertingSubtree so
     43            that HTMLObjectElement::finishedInsertingSubtree() is called.
     44            (WebCore::HTMLObjectElement::finishedInsertingSubtree): Added; turn around and
     45            call FormAssociatedElement::resetFormOwner().
     46            * html/HTMLObjectElement.h:
     47            * html/HTMLSelectElement.cpp:
     48            (WebCore::HTMLSelectElement::insertedInto): Modified to return the result of
     49            HTMLFormControlElementWithState::insertedInto(), which may schedule a callback after subtree
     50            insertion.
     51            * html/HTMLTextFormControlElement.cpp:
     52            (WebCore::HTMLTextFormControlElement::insertedInto): Ditto.
     53
    1542015-09-03  Babak Shafiei  <bshafiei@apple.com>
    255

  • branches/safari-601-branch/Source/WebCore/html/FormAssociatedElement.cpp

    r176174 r189610  
    6969void FormAssociatedElement::insertedInto(ContainerNode& insertionPoint)
    7070{
    71     resetFormOwner();
    7271    if (!insertionPoint.inDocument())
    7372        return;

  • branches/safari-601-branch/Source/WebCore/html/HTMLFormControlElement.cpp

    r182120 r189610  
    261261    HTMLElement::insertedInto(insertionPoint);
    262262    FormAssociatedElement::insertedInto(insertionPoint);
    263 
    264     return InsertionDone;
     263    return InsertionShouldCallFinishedInsertingSubtree;
     264}
     265
     266void HTMLFormControlElement::finishedInsertingSubtree()
     267{
     268    resetFormOwner();
    265269}
    266270

  • branches/safari-601-branch/Source/WebCore/html/HTMLFormControlElement.h

    r179886 r189610  
    130130    virtual void didAttachRenderers() override;
    131131    virtual InsertionNotificationRequest insertedInto(ContainerNode&) override;
     132    void finishedInsertingSubtree() override;
    132133    virtual void removedFrom(ContainerNode&) override;
    133134    virtual void didMoveToNewDocument(Document* oldDocument) override;

  • branches/safari-601-branch/Source/WebCore/html/HTMLInputElement.cpp

    r186256 r189610  
    14741474{
    14751475    HTMLTextFormControlElement::insertedInto(insertionPoint);
    1476     if (insertionPoint.inDocument() && !form())
    1477         addToRadioButtonGroup();
    14781476#if ENABLE(DATALIST_ELEMENT)
    14791477    resetListAttributeTargetObserver();
    14801478#endif
    1481     return InsertionDone;
     1479    return InsertionShouldCallFinishedInsertingSubtree;
     1480}
     1481
     1482void HTMLInputElement::finishedInsertingSubtree()
     1483{
     1484    HTMLTextFormControlElement::finishedInsertingSubtree();
     1485    if (inDocument() && !form())
     1486        addToRadioButtonGroup();
    14821487}
    14831488

  • branches/safari-601-branch/Source/WebCore/html/HTMLInputElement.h

    r183160 r189610  
    336336    virtual void didChangeForm() override final;
    337337    virtual InsertionNotificationRequest insertedInto(ContainerNode&) override final;
     338    void finishedInsertingSubtree() override final;
    338339    virtual void removedFrom(ContainerNode&) override final;
    339340    virtual void didMoveToNewDocument(Document* oldDocument) override final;

  • branches/safari-601-branch/Source/WebCore/html/HTMLObjectElement.cpp

    r181849 r189610  
    338338    HTMLPlugInImageElement::insertedInto(insertionPoint);
    339339    FormAssociatedElement::insertedInto(insertionPoint);
    340     return InsertionDone;
     340    return InsertionShouldCallFinishedInsertingSubtree;
     341}
     342
     343void HTMLObjectElement::finishedInsertingSubtree()
     344{
     345    resetFormOwner();
    341346}
    342347

  • branches/safari-601-branch/Source/WebCore/html/HTMLObjectElement.h

    r181168 r189610  
    6464
    6565    virtual InsertionNotificationRequest insertedInto(ContainerNode&) override;
     66    void finishedInsertingSubtree() override final;
    6667    virtual void removedFrom(ContainerNode&) override;
    6768

  • branches/safari-601-branch/Source/WebCore/html/HTMLSelectElement.cpp

    r183160 r189610  
    15921592    // after the whole subtree is constructed.
    15931593    recalcListItems();
    1594     HTMLFormControlElementWithState::insertedInto(insertionPoint);
    1595     return InsertionDone;
     1594    return HTMLFormControlElementWithState::insertedInto(insertionPoint);
    15961595}
    15971596

  • branches/safari-601-branch/Source/WebCore/html/HTMLTextFormControlElement.cpp

    r186256 r189610  
    7979Node::InsertionNotificationRequest HTMLTextFormControlElement::insertedInto(ContainerNode& insertionPoint)
    8080{
    81     HTMLFormControlElementWithState::insertedInto(insertionPoint);
     81    InsertionNotificationRequest insertionNotificationRequest = HTMLFormControlElementWithState::insertedInto(insertionPoint);
    8282    if (!insertionPoint.inDocument())
    83         return InsertionDone;
     83        return insertionNotificationRequest;
    8484    String initialValue = value();
    8585    setTextAsOfLastFormControlChangeEvent(initialValue.isNull() ? emptyString() : initialValue);
    86     return InsertionDone;
     86    return insertionNotificationRequest;
    8787}
    8888
Note: See TracChangeset for help on using the changeset viewer.