Skip to content

GitLab

T
tangled
Commit 63984bea authored by kangil.han@samsung.com's avatar kangil.han@samsung.com
Browse files
Options

Range.insertNode should verify parent before setting end to it 

This is because ContainerNode::insertBefore would cause mutation in tree.
So this CL adds code block to throw exception if parent is not avaiable.
In addition, http://crbug.com/399230 will be fixed with this CL.

BUG=399230
TEST=LayoutTests/fast/dom/Range/surroundContents-for-mutation.html

Review URL: https://codereview.chromium.org/443103002

git-svn-id: svn://svn.chromium.org/blink/trunk@179828 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 4778d110
Hide whitespace changes
Inline Side-by-side
Showing with 45 additions and 1 deletion
third_party/WebKit/LayoutTests/fast/dom/Range/surroundContents-for-mutation-expected.txt 0 → 100644
View file @ 63984bea
PASS range.surroundContents(testFrame) threw exception HierarchyRequestError: Failed to execute 'surroundContents' on 'Range': This operation would set range's end to parent with new offset, but there's no parent into which to continue..
PASS successfullyParsed is true
TEST COMPLETE
third_party/WebKit/LayoutTests/fast/dom/Range/surroundContents-for-mutation.html 0 → 100644
View file @ 63984bea
<html>
<head>
<script src="../../../resources/js-test.js"></script>
</head>
<body>
<div id='container'>
<p id='start'>start</p>
<iframe id='test'></iframe>
<p id='end'>end</p>
</div>
<script>
var range = document.createRange();
var start = document.getElementById('start');
range.setStart(start.firstChild, 0);
range.setEnd(start.firstChild, 0);
function loaded(ev) {
var srcElement = ev.srcElement;
range.surroundContents(document.getElementById('end'));
srcElement.outerHTML = '';
}
document.addEventListener("load", loaded, true);
var testFrame = document.getElementById('test');
shouldThrow("range.surroundContents(testFrame)", '"HierarchyRequestError: Failed to execute \'surroundContents\' on \'Range\': This operation would set range\'s end to parent with new offset, but there\'s no parent into which to continue."');
if (window.testRunner)
document.getElementById('container').outerHTML = '';
</script>
</body>
</html>
third_party/WebKit/Source/core/dom/Range.cpp
View file @ 63984bea
......@@ -894,8 +894,16 @@ void Range::insertNode(PassRefPtrWillBeRawPtr<Node> prpNewNode, ExceptionState&
if (exceptionState.hadException())
return;
if (collapsed)
if (collapsed) {
// The load event would be fired regardless of EventQueueScope;
// e.g. by ContainerNode::updateTreeAfterInsertion
// Given circumstance may mutate the tree so newText->parentNode() may become null
if (!newText->parentNode()) {
exceptionState.throwDOMException(HierarchyRequestError, "This operation would set range's end to parent with new offset, but there's no parent into which to continue.");
return;
}
m_end.setToBeforeChild(*newText);
}
} else {
RefPtrWillBeRawPtr<Node> lastChild = (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) ? toDocumentFragment(newNode)->lastChild() : newNode.get();
if (lastChild && lastChild == m_start.childBefore()) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment