Changeset 48037 in webkit

Timestamp:

Sep 3, 2009 5:27:48 PM (15 years ago)

Author:

ap@apple.com

Message:

Reviewed by Darin Adler.

<rdar://problem/7180197>, ​https://bugs.webkit.org/show_bug.cgi?id=28822
REGRESSION(r31231): Creating document with current document's DOCTYPE causes crashes

Test: fast/dom/DOMImplementation/createDocument-with-used-doctype.html

• dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createDocument): Even though we cannot raise an exception immediately out of fear of breaking Acid3, we shouldn't use a DocumentType node in two documents.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/DOMImplementation/createDocument-with-used-doctype-expected.txt (added)
• LayoutTests/fast/dom/DOMImplementation/createDocument-with-used-doctype.html (added)
• LayoutTests/fast/dom/DOMImplementation/resources/createDocument-with-used-doctype-frame.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/dom/DOMImplementation.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-09-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7180197>, https://bugs.webkit.org/show_bug.cgi?id=28822
+        REGRESSION(r31231): Creating document with current document's DOCTYPE causes crashes
+
+        This bug demonstrates itself with a crash later on, not in the current test.
+
+        * fast/dom/DOMImplementation/createDocument-with-used-doctype-expected.txt: Added.
+        * fast/dom/DOMImplementation/createDocument-with-used-doctype.html: Added.
+        * fast/dom/DOMImplementation/resources/createDocument-with-used-doctype-frame.html: Added.
+
 2009-09-03  Brady Eidson  <beidson@apple.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-09-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7180197>, https://bugs.webkit.org/show_bug.cgi?id=28822
+        REGRESSION(r31231): Creating document with current document's DOCTYPE causes crashes
+
+        Test: fast/dom/DOMImplementation/createDocument-with-used-doctype.html
+
+        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createDocument): Even though we
+        cannot raise an exception immediately out of fear of breaking Acid3, we shouldn't use a
+        DocumentType node in two documents.
+
 2009-09-03  Brady Eidson  <beidson@apple.com>
 

trunk/WebCore/dom/DOMImplementation.cpp

@@ -224 +224 @@
     const String& qualifiedName, DocumentType* doctype, ExceptionCode& ec)
 {
-    // WRONG_DOCUMENT_ERR: Raised if doctype has already been used with a different document or was
-    // created from a different implementation.
-    bool shouldThrowWrongDocErr = false;
-    if (doctype && doctype->document())
-        shouldThrowWrongDocErr = true;
-
     RefPtr<Document> doc;
 #if ENABLE(SVG)
@@ -246 +240 @@
         doc = Document::create(0);
 
-    // now get the interesting parts of the doctype
+    RefPtr<Node> documentElement;
+    if (!qualifiedName.isEmpty()) {
+        documentElement = doc->createElementNS(namespaceURI, qualifiedName, ec);
+        if (ec)
+            return 0;
+    }
+
+    // WRONG_DOCUMENT_ERR: Raised if doctype has already been used with a different document or was
+    // created from a different implementation.
+    // Hixie's interpretation of the DOM Core spec suggests we should prefer
+    // other exceptions to WRONG_DOCUMENT_ERR (based on order mentioned in spec).
+    if (doctype && doctype->document()) {
+        ec = WRONG_DOCUMENT_ERR;
+        return 0;
+    }
+
     if (doctype)
         doc->addChild(doctype);
-
-    if (!qualifiedName.isEmpty()) {
-        RefPtr<Node> documentElement = doc->createElementNS(namespaceURI, qualifiedName, ec);
-        if (ec)
-            return 0;
+    if (documentElement)
         doc->addChild(documentElement.release());
-    }
-
-    // Hixie's interpretation of the DOM Core spec suggests we should prefer
-    // other exceptions to WRONG_DOCUMENT_ERR (based on order mentioned in spec)
-    if (shouldThrowWrongDocErr) {
-        ec = WRONG_DOCUMENT_ERR;
-        return 0;
-    }
 
     return doc.release();