Changeset 154037 in webkit

Timestamp:

Aug 13, 2013 7:16:56 PM (11 years ago)

Author:

rniwa@webkit.org

Message:

REGRESSION(r150187): Safari fails to render allrecipe.com comment popups
​https://bugs.webkit.org/show_bug.cgi?id=119780

Reviewed by Benjamin Poulain.

Source/WebCore:

The bug was caused by SelectorDataList::executeFastPathForIdSelector not verifying that
elements found by getAllElementsById are descendents of rootNode when there are multiple
elements of the same id. This resulted in querySelector and querySelectorAll of an element
returning nodes outside of the element.

Fixed the bug by checking this condition when we have multiple elements of the same id.

Test: fast/selectors/querySelector-id-with-multiple-elements-with-same-id.html

• dom/SelectorQuery.cpp:

(WebCore::SelectorDataList::executeFastPathForIdSelector):

LayoutTests:

• fast/selectors/querySelector-id-with-multiple-elements-with-same-id-expected.txt: Added.
• fast/selectors/querySelector-id-with-multiple-elements-with-same-id.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/selectors/querySelector-id-with-multiple-elements-with-same-id-expected.txt (added)
• LayoutTests/fast/selectors/querySelector-id-with-multiple-elements-with-same-id.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/SelectorQuery.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-08-13  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r150187): Safari fails to render allrecipe.com comment popups
+        https://bugs.webkit.org/show_bug.cgi?id=119780
+
+        Reviewed by Benjamin Poulain.
+
+        * fast/selectors/querySelector-id-with-multiple-elements-with-same-id-expected.txt: Added.
+        * fast/selectors/querySelector-id-with-multiple-elements-with-same-id.html: Added.
+
 2013-08-13  Sam Weinig  <sam@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-08-13  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r150187): Safari fails to render allrecipe.com comment popups
+        https://bugs.webkit.org/show_bug.cgi?id=119780
+
+        Reviewed by Benjamin Poulain.
+
+        The bug was caused by SelectorDataList::executeFastPathForIdSelector not verifying that
+        elements found by getAllElementsById are descendents of rootNode when there are multiple
+        elements of the same id. This resulted in querySelector and querySelectorAll of an element
+        returning nodes outside of the element.
+
+        Fixed the bug by checking this condition when we have multiple elements of the same id.
+
+        Test: fast/selectors/querySelector-id-with-multiple-elements-with-same-id.html
+
+        * dom/SelectorQuery.cpp:
+        (WebCore::SelectorDataList::executeFastPathForIdSelector):
+
 2013-08-12  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/dom/SelectorQuery.cpp

@@ -133 +133 @@
         ASSERT(elements);
         size_t count = elements->size();
+        bool rootNodeIsTreeScopeRoot = isTreeScopeRoot(rootNode);
         for (size_t i = 0; i < count; ++i) {
             Element* element = elements->at(i);
-            if (selectorMatches(selectorData, element, rootNode)) {
+            if ((rootNodeIsTreeScopeRoot || element->isDescendantOf(rootNode)) && selectorMatches(selectorData, element, rootNode)) {
                 matchedElements.append(element);
                 if (firstMatchOnly)