Changeset 42351 in webkit

Timestamp:

Apr 9, 2009 3:40:30 AM (15 years ago)

Author:

eric@webkit.org

Message:

Reviewed by Oliver Hunt.

Fix document.implementation.createDocument(null, "a:b") not to crash!
​https://bugs.webkit.org/show_bug.cgi?id=25096

Test: fast/dom/DOMImplementation/createDocument-namespace-err.html

• dom/ContainerNode.cpp: (WebCore::ContainerNode::addChild): add ASSERT() to give a better crash next time
• dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createDocument): check the exception code before using the result

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/DOMImplementation/createDocument-namespace-err-expected.txt (added)
• LayoutTests/fast/dom/DOMImplementation/createDocument-namespace-err.html (added)
• LayoutTests/fast/dom/DOMImplementation/resources/createDocument-namespace-err.js (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/dom/ContainerNode.cpp (modified) (1 diff)
• WebCore/dom/DOMImplementation.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-04-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Test cases for document.implementation.createDocument
+        https://bugs.webkit.org/show_bug.cgi?id=25096
+
+        We fail some of these tests (as does Mozilla)
+        I didn't want to add a behavior change to this crash fix, so I filed
+        https://bugs.webkit.org/show_bug.cgi?id=25111 as a follow-up bug.
+
+        * fast/dom/DOMImplementation/createDocument-namespace-err-expected.txt: Added.
+        * fast/dom/DOMImplementation/createDocument-namespace-err.html: Added.
+        * fast/dom/DOMImplementation/resources/createDocument-namespace-err.js: Copied from fast/dom/Document/resources/createElementNS-namespace-err.js
+
 2009-04-08  Oliver Hunt  <oliver@apple.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-04-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix document.implementation.createDocument(null, "a:b") not to crash!
+        https://bugs.webkit.org/show_bug.cgi?id=25096
+
+        Test: fast/dom/DOMImplementation/createDocument-namespace-err.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::addChild): add ASSERT() to give a better crash next time
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument): check the exception code before using the result
+
 2009-04-08  Adam Roben  <aroben@apple.com>
 

trunk/WebCore/dom/ContainerNode.cpp

@@ -503 +503 @@
 ContainerNode* ContainerNode::addChild(PassRefPtr<Node> newChild)
 {
+    ASSERT(newChild);
     // This function is only used during parsing.
     // It does not send any DOM mutation events.

trunk/WebCore/dom/DOMImplementation.cpp

@@ -251 +251 @@
 
     if (!qualifiedName.isEmpty()) {
-        doc->addChild(doc->createElementNS(namespaceURI, qualifiedName, ec));
-        if (ec != 0)
+        RefPtr<Node> documentElement = doc->createElementNS(namespaceURI, qualifiedName, ec);
+        if (ec)
             return 0;
+        doc->addChild(documentElement.release());
     }