Changeset 83699 in webkit

Timestamp:

Apr 12, 2011 10:07:59 PM (13 years ago)

Author:

commit-queue@webkit.org

Message:

2011-04-12 Sergey Glazunov <​serg.glazunov@gmail.com>

Reviewed by Dimitri Glazkov.

Element::setAttribute should check the namespace of an id attribute
​https://bugs.webkit.org/show_bug.cgi?id=58359

• fast/dom/id-attribute-with-namespace-crash-expected.txt: Added.
• fast/dom/id-attribute-with-namespace-crash.html: Added.

2011-04-12 Sergey Glazunov <​serg.glazunov@gmail.com>

Reviewed by Dimitri Glazkov.

Element::setAttribute should check the namespace of an id attribute
​https://bugs.webkit.org/show_bug.cgi?id=58359

Test: fast/dom/id-attribute-with-namespace-crash.html

• dom/Element.cpp: (WebCore::Element::setAttribute):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/id-attribute-with-namespace-crash-expected.txt (added)
• LayoutTests/fast/dom/id-attribute-with-namespace-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Element.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-04-12  Sergey Glazunov  <serg.glazunov@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Element::setAttribute should check the namespace of an id attribute
+        https://bugs.webkit.org/show_bug.cgi?id=58359
+
+        * fast/dom/id-attribute-with-namespace-crash-expected.txt: Added.
+        * fast/dom/id-attribute-with-namespace-crash.html: Added.
+
 2011-04-12  Andrey Kosyakov  <caseq@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-04-12  Sergey Glazunov  <serg.glazunov@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Element::setAttribute should check the namespace of an id attribute
+        https://bugs.webkit.org/show_bug.cgi?id=58359
+
+        Test: fast/dom/id-attribute-with-namespace-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute):
+
 2011-04-12  Mike Lawther  <mikelawther@chromium.org>
 

trunk/Source/WebCore/dom/Element.cpp

@@ -658 +658 @@
 
     const AtomicString& localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-
+    QualifiedName attributeName(nullAtom, localName, nullAtom);
+    
     // Allocate attribute map if necessary.
     Attribute* old = attributes(false)->getAttributeItem(localName, false);
@@ -664 +665 @@
     document()->incDOMTreeVersion();
 
-    // FIXME: This check is probably not correct for the case where the document has an id attribute
-    // with a non-null namespace, because it will return true if the local name happens to match
-    // but the namespace does not.
-    if (localName == document()->idAttributeName().localName())
+    if (isIdAttributeName(old ? old->name() : attributeName))
         updateId(old ? old->value() : nullAtom, value);
 
@@ -673 +671 @@
         m_attributeMap->removeAttribute(old->name());
     else if (!old && !value.isNull())
-        m_attributeMap->addAttribute(createAttribute(QualifiedName(nullAtom, localName, nullAtom), value));
+        m_attributeMap->addAttribute(createAttribute(attributeName, value));
     else if (old && !value.isNull()) {
         if (Attr* attrNode = old->attr())