Changeset 159389 in webkit

Timestamp:

Nov 17, 2013, 1:37:25 PM (11 years ago)

Author:

Antti Koivisto

Message:

REGRESSION (r158774): Iteration over element children is broken
​https://bugs.webkit.org/show_bug.cgi?id=124145

Source/WebCore:

Reviewed by Anders Carlsson.

Mutation during traversal invalidates the position cache. After the mid-point we start
traversing backwards as it the shortest path. However backward traversal of children-only
HTMLCollection was wrong and would end up going to descendants.

Reduction by ​yannick.poirier@inverto.tv.

Test: fast/dom/htmlcollection-children-mutation.html

• html/HTMLCollection.cpp:

(WebCore::HTMLCollection::collectionTraverseBackward):

Traverse direct children only when m_shouldOnlyIncludeDirectChildren bit is set.

LayoutTests:

Reviewed by Anders Carlsson.

• fast/dom/htmlcollection-children-mutation-expected.txt: Added.
• fast/dom/htmlcollection-children-mutation.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/htmlcollection-children-mutation-expected.txt (added)
• LayoutTests/fast/dom/htmlcollection-children-mutation.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/HTMLCollection.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-11-17  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION (r158774): Iteration over element children is broken
+        https://bugs.webkit.org/show_bug.cgi?id=124145
+
+        Reviewed by Anders Carlsson.
+
+        * fast/dom/htmlcollection-children-mutation-expected.txt: Added.
+        * fast/dom/htmlcollection-children-mutation.html: Added.
+
 2013-11-17  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-11-17  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION (r158774): Iteration over element children is broken
+        https://bugs.webkit.org/show_bug.cgi?id=124145
+
+        Reviewed by Anders Carlsson.
+        
+        Mutation during traversal invalidates the position cache. After the mid-point we start
+        traversing backwards as it the shortest path. However backward traversal of children-only
+        HTMLCollection was wrong and would end up going to descendants.
+        
+        Reduction by yannick.poirier@inverto.tv.
+
+        Test: fast/dom/htmlcollection-children-mutation.html
+
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::collectionTraverseBackward):
+        
+            Traverse direct children only when m_shouldOnlyIncludeDirectChildren bit is set.
+
 2013-11-17  Zoltan Horvath  <zoltan@webkit.org>
 

trunk/Source/WebCore/html/HTMLCollection.cpp

@@ -355 +355 @@
     auto& root = rootNode();
     Element* element = &current;
+    if (m_shouldOnlyIncludeDirectChildren) {
+        for (; count && element ; --count)
+            element = iterateForPreviousElement(ElementTraversal::previousSibling(element));
+        return element;
+    }
     for (; count && element ; --count)
         element = iterateForPreviousElement(ElementTraversal::previous(element, &root));