Title: [209130] trunk
Revision
209130
Author
bfulg...@apple.com
Date
2016-11-30 09:03:48 -0800 (Wed, 30 Nov 2016)

Log Message

Use 'childOfType' template when retrieving Shadow DOM elements
https://bugs.webkit.org/show_bug.cgi?id=165145
<rdar://problem/29331830>

Reviewed by Antti Koivisto.

Source/WebCore:

Tests: fast/shadow-dom/color-input-element-shadow-manipulation.html
       fast/shadow-dom/file-input-element-shadow-manipulation.html
       fast/shadow-dom/keygen-shadow-manipulation.html
       fast/shadow-dom/media-shadow-manipulation.html
       fast/shadow-dom/range-input-element-shadow-manipulation.html
       fast/shadow-dom/textarea-shadow-manipulation.html

Switch to using 'childOfType' when retrieving Shadow DOM elements, rather
than relying on expected element positions, as these can be changed by
_javascript_.

Drive by fix: Make more use of is<> and downcast<> templates rather than blindly casting.

* dom/Element.h:
(WebCore::Element::isUploadButton): Added.
(WebCore::Element::isSliderContainerElement): Added.
* html/ColorInputType.cpp:
(WebCore::ColorInputType::shadowColorSwatch): Use 'childOfType' rather than assuming
the first child is the one we want.
* html/FileInputType.cpp:
(isType): Added.
(WebCore::FileInputType::disabledAttributeChanged): Use 'childOfType' rather than assuming
the first child is the one we want.
(WebCore::FileInputType::multipleAttributeChanged): Ditto.
* html/HTMLKeygenElement.cpp:
(WebCore::HTMLKeygenElement::shadowSelect): Ditto.
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::mediaControls): Ditto.
(WebCore::HTMLMediaElement::hasMediaControls): Ditto.
* html/HTMLTextAreaElement.cpp:
(WebCore::HTMLTextAreaElement::innerTextElement): Ditto.
* html/RangeInputType.cpp:
(WebCore::RangeInputType::sliderTrackElement): Ditto.
* html/shadow/SliderThumbElement.h:
(isType): Added.
* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::targetClone): Use 'childOfType' rather than assuming
the first child is the one we want.

LayoutTests:

* fast/shadow-dom/color-input-element-shadow-manipulation-expected.txt: Added.
* fast/shadow-dom/color-input-element-shadow-manipulation.html: Added.
* fast/shadow-dom/file-input-element-shadow-manipulation-expected.txt: Added.
* fast/shadow-dom/file-input-element-shadow-manipulation.html: Added.
* fast/shadow-dom/keygen-shadow-manipulation-expected.txt: Added.
* fast/shadow-dom/keygen-shadow-manipulation.html: Added.
* fast/shadow-dom/media-shadow-manipulation-expected.txt: Added.
* fast/shadow-dom/media-shadow-manipulation.html: Added.
* fast/shadow-dom/range-input-element-shadow-manipulation-expected.txt: Added.
* fast/shadow-dom/range-input-element-shadow-manipulation.html: Added.
* fast/shadow-dom/textarea-shadow-manipulation-expected.txt: Added.
* fast/shadow-dom/textarea-shadow-manipulation.html: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (209129 => 209130)


--- trunk/LayoutTests/ChangeLog	2016-11-30 16:59:11 UTC (rev 209129)
+++ trunk/LayoutTests/ChangeLog	2016-11-30 17:03:48 UTC (rev 209130)
@@ -1,3 +1,24 @@
+2016-11-29  Brent Fulgham  <bfulg...@apple.com>
+
+        Use 'childOfType' template when retrieving Shadow DOM elements
+        https://bugs.webkit.org/show_bug.cgi?id=165145
+        <rdar://problem/29331830>
+
+        Reviewed by Antti Koivisto.
+
+        * fast/shadow-dom/color-input-element-shadow-manipulation-expected.txt: Added.
+        * fast/shadow-dom/color-input-element-shadow-manipulation.html: Added.
+        * fast/shadow-dom/file-input-element-shadow-manipulation-expected.txt: Added.
+        * fast/shadow-dom/file-input-element-shadow-manipulation.html: Added.
+        * fast/shadow-dom/keygen-shadow-manipulation-expected.txt: Added.
+        * fast/shadow-dom/keygen-shadow-manipulation.html: Added.
+        * fast/shadow-dom/media-shadow-manipulation-expected.txt: Added.
+        * fast/shadow-dom/media-shadow-manipulation.html: Added.
+        * fast/shadow-dom/range-input-element-shadow-manipulation-expected.txt: Added.
+        * fast/shadow-dom/range-input-element-shadow-manipulation.html: Added.
+        * fast/shadow-dom/textarea-shadow-manipulation-expected.txt: Added.
+        * fast/shadow-dom/textarea-shadow-manipulation.html: Added.
+
 2016-11-30  Dave Hyatt  <hy...@apple.com>
 
         [CSS Parser] Mark a bunch of tests as able to fail

Added: trunk/LayoutTests/fast/shadow-dom/color-input-element-shadow-manipulation-expected.txt (0 => 209130)


--- trunk/LayoutTests/fast/shadow-dom/color-input-element-shadow-manipulation-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/color-input-element-shadow-manipulation-expected.txt	2016-11-30 17:03:48 UTC (rev 209130)
@@ -0,0 +1,5 @@
+PASS Passes if we did not debug assert.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+foo 

Added: trunk/LayoutTests/fast/shadow-dom/color-input-element-shadow-manipulation.html (0 => 209130)


--- trunk/LayoutTests/fast/shadow-dom/color-input-element-shadow-manipulation.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/color-input-element-shadow-manipulation.html	2016-11-30 17:03:48 UTC (rev 209130)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+function runTest() {
+    var bounds = color_input_element.getBoundingClientRect();
+    var range = document.caretRangeFromPoint(bounds.left + 10, bounds.top + 10);
+    var shadow_tree_container = range.commonAncestorContainer;
+    shadow_tree_container.prepend("foo");
+    color_input_element.disabled = true;
+    testPassed("Passes if we did not debug assert.");
+    finishJSTest();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+    <input type="color" id="color_input_element" style="position:absolute; height: 100px; width: 100px;">
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/file-input-element-shadow-manipulation-expected.txt (0 => 209130)


--- trunk/LayoutTests/fast/shadow-dom/file-input-element-shadow-manipulation-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/file-input-element-shadow-manipulation-expected.txt	2016-11-30 17:03:48 UTC (rev 209130)
@@ -0,0 +1,5 @@
+PASS Passes if we did not debug assert.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+foo 

Added: trunk/LayoutTests/fast/shadow-dom/file-input-element-shadow-manipulation.html (0 => 209130)


--- trunk/LayoutTests/fast/shadow-dom/file-input-element-shadow-manipulation.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/file-input-element-shadow-manipulation.html	2016-11-30 17:03:48 UTC (rev 209130)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+function runTest() {
+    var bounds = file_input_element.getBoundingClientRect();
+    var range = document.caretRangeFromPoint(bounds.left + 10, bounds.top + 10);
+    var shadow_tree_container = range.commonAncestorContainer;
+    shadow_tree_container.prepend("foo");
+    file_input_element.disabled = true;
+    testPassed("Passes if we did not debug assert.");
+    finishJSTest();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+    <input type="file" id="file_input_element" style="position:absolute; height: 100px; width: 100px;">
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/keygen-shadow-manipulation-expected.txt (0 => 209130)


--- trunk/LayoutTests/fast/shadow-dom/keygen-shadow-manipulation-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/keygen-shadow-manipulation-expected.txt	2016-11-30 17:03:48 UTC (rev 209130)
@@ -0,0 +1,5 @@
+PASS Passes if we did not debug assert.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Added: trunk/LayoutTests/fast/shadow-dom/keygen-shadow-manipulation.html (0 => 209130)


--- trunk/LayoutTests/fast/shadow-dom/keygen-shadow-manipulation.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/keygen-shadow-manipulation.html	2016-11-30 17:03:48 UTC (rev 209130)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+function runTest() {
+    var bounds = keygen_element.getBoundingClientRect();
+    var range = document.caretRangeFromPoint(bounds.left + bounds.width / 2, bounds.top + bounds.height / 2);
+    var shadow_tree_container = range.commonAncestorContainer;
+    shadow_tree_container.prepend("foo");
+    keygen_element.disabled = true;
+    testPassed("Passes if we did not debug assert.");
+    finishJSTest();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+    <keygen id="keygen_element" style="position:absolute; height: 100px; width: 100px;">
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/media-shadow-manipulation-expected.txt (0 => 209130)


--- trunk/LayoutTests/fast/shadow-dom/media-shadow-manipulation-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/media-shadow-manipulation-expected.txt	2016-11-30 17:03:48 UTC (rev 209130)
@@ -0,0 +1,5 @@
+PASS Passes if we did not debug assert.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+foo 

Added: trunk/LayoutTests/fast/shadow-dom/media-shadow-manipulation.html (0 => 209130)


--- trunk/LayoutTests/fast/shadow-dom/media-shadow-manipulation.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/media-shadow-manipulation.html	2016-11-30 17:03:48 UTC (rev 209130)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+function runTest() {
+    var bounds = video_element.getBoundingClientRect();
+    var range = document.caretRangeFromPoint(bounds.left + 10, bounds.bottom - 10);
+    var shadow_tree_container = range.commonAncestorContainer;
+    shadow_tree_container.prepend("foo");
+    video_element.disabled = true;
+    testPassed("Passes if we did not debug assert.");
+    finishJSTest();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+    <video id="video_element" style="position:absolute; height: 240px; width: 320px;" controls></video>
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/range-input-element-shadow-manipulation-expected.txt (0 => 209130)


--- trunk/LayoutTests/fast/shadow-dom/range-input-element-shadow-manipulation-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/range-input-element-shadow-manipulation-expected.txt	2016-11-30 17:03:48 UTC (rev 209130)
@@ -0,0 +1,5 @@
+PASS Passes if we did not debug assert.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+foo 

Added: trunk/LayoutTests/fast/shadow-dom/range-input-element-shadow-manipulation.html (0 => 209130)


--- trunk/LayoutTests/fast/shadow-dom/range-input-element-shadow-manipulation.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/range-input-element-shadow-manipulation.html	2016-11-30 17:03:48 UTC (rev 209130)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+function runTest() {
+    var bounds = range_input_element.getBoundingClientRect();
+    var range = document.caretRangeFromPoint(bounds.left + bounds.width / 2, bounds.top + bounds.height / 2);
+    var shadow_tree_container = range.commonAncestorContainer;
+    shadow_tree_container.prepend("foo");
+    range_input_element.disabled = true;
+    testPassed("Passes if we did not debug assert.");
+    finishJSTest();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+    <input type="range" id="range_input_element" style="position:absolute; height: 30px; width: 100px;">
+</body>
+</html>

Added: trunk/LayoutTests/fast/shadow-dom/textarea-shadow-manipulation-expected.txt (0 => 209130)


--- trunk/LayoutTests/fast/shadow-dom/textarea-shadow-manipulation-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/textarea-shadow-manipulation-expected.txt	2016-11-30 17:03:48 UTC (rev 209130)
@@ -0,0 +1,5 @@
+PASS Passes if we did not debug assert.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+foo 

Added: trunk/LayoutTests/fast/shadow-dom/textarea-shadow-manipulation.html (0 => 209130)


--- trunk/LayoutTests/fast/shadow-dom/textarea-shadow-manipulation.html	                        (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/textarea-shadow-manipulation.html	2016-11-30 17:03:48 UTC (rev 209130)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+function runTest() {
+    var bounds = textarea_element.getBoundingClientRect();
+    var range = document.caretRangeFromPoint(bounds.left + bounds.width / 2, bounds.top + bounds.height / 2);
+    var shadow_tree_container = range.commonAncestorContainer;
+    shadow_tree_container.prepend("foo");
+    textarea_element.disabled = true;
+    testPassed("Passes if we did not debug assert.");
+    finishJSTest();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+    <textarea id="textarea_element" style="position:absolute; height: 100px; width: 100px;">Text Area</textarea>
+</body>
+</html>

Modified: trunk/Source/WebCore/ChangeLog (209129 => 209130)


--- trunk/Source/WebCore/ChangeLog	2016-11-30 16:59:11 UTC (rev 209129)
+++ trunk/Source/WebCore/ChangeLog	2016-11-30 17:03:48 UTC (rev 209130)
@@ -1,3 +1,50 @@
+2016-11-29  Brent Fulgham  <bfulg...@apple.com>
+
+        Use 'childOfType' template when retrieving Shadow DOM elements
+        https://bugs.webkit.org/show_bug.cgi?id=165145
+        <rdar://problem/29331830>
+
+        Reviewed by Antti Koivisto.
+
+        Tests: fast/shadow-dom/color-input-element-shadow-manipulation.html
+               fast/shadow-dom/file-input-element-shadow-manipulation.html
+               fast/shadow-dom/keygen-shadow-manipulation.html
+               fast/shadow-dom/media-shadow-manipulation.html
+               fast/shadow-dom/range-input-element-shadow-manipulation.html
+               fast/shadow-dom/textarea-shadow-manipulation.html
+
+        Switch to using 'childOfType' when retrieving Shadow DOM elements, rather
+        than relying on expected element positions, as these can be changed by
+        _javascript_.
+
+        Drive by fix: Make more use of is<> and downcast<> templates rather than blindly casting.
+
+        * dom/Element.h:
+        (WebCore::Element::isUploadButton): Added.
+        (WebCore::Element::isSliderContainerElement): Added.
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::shadowColorSwatch): Use 'childOfType' rather than assuming
+        the first child is the one we want.
+        * html/FileInputType.cpp:
+        (isType): Added.
+        (WebCore::FileInputType::disabledAttributeChanged): Use 'childOfType' rather than assuming
+        the first child is the one we want.
+        (WebCore::FileInputType::multipleAttributeChanged): Ditto.
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::shadowSelect): Ditto.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaControls): Ditto.
+        (WebCore::HTMLMediaElement::hasMediaControls): Ditto.
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::innerTextElement): Ditto.
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::sliderTrackElement): Ditto.
+        * html/shadow/SliderThumbElement.h:
+        (isType): Added.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::targetClone): Use 'childOfType' rather than assuming
+        the first child is the one we want.
+
 2016-11-30  Darin Adler  <da...@apple.com>
 
         Streamline and speed up tokenizer and segmented string classes

Modified: trunk/Source/WebCore/dom/Element.h (209129 => 209130)


--- trunk/Source/WebCore/dom/Element.h	2016-11-30 16:59:11 UTC (rev 209129)
+++ trunk/Source/WebCore/dom/Element.h	2016-11-30 17:03:48 UTC (rev 209130)
@@ -444,6 +444,8 @@
     virtual bool isInRange() const { return false; }
     virtual bool isOutOfRange() const { return false; }
     virtual bool isFrameElementBase() const { return false; }
+    virtual bool isUploadButton() const { return false; }
+    virtual bool isSliderContainerElement() const { return false; }
 
     bool canContainRangeEndPoint() const override;
 

Modified: trunk/Source/WebCore/html/ColorInputType.cpp (209129 => 209130)


--- trunk/Source/WebCore/html/ColorInputType.cpp	2016-11-30 16:59:11 UTC (rev 209129)
+++ trunk/Source/WebCore/html/ColorInputType.cpp	2016-11-30 17:03:48 UTC (rev 209130)
@@ -38,6 +38,7 @@
 #include "CSSPropertyNames.h"
 #include "Chrome.h"
 #include "Color.h"
+#include "ElementChildIterator.h"
 #include "Event.h"
 #include "HTMLDataListElement.h"
 #include "HTMLDivElement.h"
@@ -216,7 +217,14 @@
 HTMLElement* ColorInputType::shadowColorSwatch() const
 {
     ShadowRoot* shadow = element().userAgentShadowRoot();
-    return shadow ? downcast<HTMLElement>(shadow->firstChild()->firstChild()) : nullptr;
+    if (!shadow)
+        return nullptr;
+
+    auto wrapper = childrenOfType<HTMLDivElement>(*shadow).first();
+    if (!wrapper)
+        return nullptr;
+
+    return childrenOfType<HTMLDivElement>(*wrapper).first();
 }
 
 IntRect ColorInputType::elementRectRelativeToRootView() const

Modified: trunk/Source/WebCore/html/FileInputType.cpp (209129 => 209130)


--- trunk/Source/WebCore/html/FileInputType.cpp	2016-11-30 16:59:11 UTC (rev 209129)
+++ trunk/Source/WebCore/html/FileInputType.cpp	2016-11-30 17:03:48 UTC (rev 209130)
@@ -24,6 +24,7 @@
 
 #include "Chrome.h"
 #include "DragData.h"
+#include "ElementChildIterator.h"
 #include "Event.h"
 #include "File.h"
 #include "FileList.h"
@@ -39,10 +40,21 @@
 #include "RenderFileUploadControl.h"
 #include "ScriptController.h"
 #include "ShadowRoot.h"
+#include <wtf/TypeCasts.h>
 #include <wtf/text/StringBuilder.h>
 
+
 namespace WebCore {
+class UploadButtonElement;
+}
 
+SPECIALIZE_TYPE_TRAITS_BEGIN(WebCore::UploadButtonElement)
+    static bool isType(const WebCore::Element& element) { return element.isUploadButton(); }
+    static bool isType(const WebCore::Node& node) { return is<WebCore::Element>(node) && isType(downcast<WebCore::Element>(node)); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+namespace WebCore {
+
 using namespace HTMLNames;
 
 class UploadButtonElement final : public HTMLInputElement {
@@ -51,6 +63,8 @@
     static Ref<UploadButtonElement> createForMultiple(Document&);
 
 private:
+    bool isUploadButton() const override { return true; }
+    
     UploadButtonElement(Document&);
 };
 
@@ -267,8 +281,12 @@
 void FileInputType::disabledAttributeChanged()
 {
     ASSERT(element().shadowRoot());
-    UploadButtonElement* button = static_cast<UploadButtonElement*>(element().userAgentShadowRoot()->firstChild());
-    if (button)
+
+    ShadowRoot* root = element().userAgentShadowRoot();
+    if (!root)
+        return;
+    
+    if (auto* button = childrenOfType<UploadButtonElement>(*root).first())
         button->setBooleanAttribute(disabledAttr, element().isDisabledFormControl());
 }
 
@@ -275,8 +293,12 @@
 void FileInputType::multipleAttributeChanged()
 {
     ASSERT(element().shadowRoot());
-    UploadButtonElement* button = static_cast<UploadButtonElement*>(element().userAgentShadowRoot()->firstChild());
-    if (button)
+
+    ShadowRoot* root = element().userAgentShadowRoot();
+    if (!root)
+        return;
+
+    if (auto* button = childrenOfType<UploadButtonElement>(*root).first())
         button->setValue(element().multiple() ? fileButtonChooseMultipleFilesLabel() : fileButtonChooseFileLabel());
 }
 

Modified: trunk/Source/WebCore/html/HTMLKeygenElement.cpp (209129 => 209130)


--- trunk/Source/WebCore/html/HTMLKeygenElement.cpp	2016-11-30 16:59:11 UTC (rev 209129)
+++ trunk/Source/WebCore/html/HTMLKeygenElement.cpp	2016-11-30 17:03:48 UTC (rev 209130)
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (kn...@kde.org)
  *           (C) 1999 Antti Koivisto (koivi...@kde.org)
  *           (C) 2001 Dirk Mueller (muel...@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2004-2006, 2010, 2012-2016 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (a...@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ -27,6 +27,7 @@
 
 #include "Attribute.h"
 #include "Document.h"
+#include "ElementChildIterator.h"
 #include "FormDataList.h"
 #include "HTMLNames.h"
 #include "HTMLSelectElement.h"
@@ -146,6 +147,12 @@
 {
     ShadowRoot* root = userAgentShadowRoot();
     return root ? downcast<HTMLSelectElement>(root->firstChild()) : nullptr;
+    /*
+    if (!root)
+        return nullptr;
+
+    return childrenOfType<HTMLSelectElement>(*root).first();
+     */
 }
 
 } // namespace

Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (209129 => 209130)


--- trunk/Source/WebCore/html/HTMLMediaElement.cpp	2016-11-30 16:59:11 UTC (rev 209129)
+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp	2016-11-30 17:03:48 UTC (rev 209130)
@@ -5777,9 +5777,13 @@
 MediaControls* HTMLMediaElement::mediaControls() const
 {
 #if ENABLE(MEDIA_CONTROLS_SCRIPT)
-    return 0;
+    return nullptr;
 #else
-    return toMediaControls(userAgentShadowRoot()->firstChild());
+    ShadowRoot* root = userAgentShadowRoot();
+    if (!root)
+        return nullptr;
+    
+    return childrenOfType<MediaControls>(*root).first();
 #endif
 }
 
@@ -5790,7 +5794,7 @@
 #else
 
     if (ShadowRoot* userAgent = userAgentShadowRoot()) {
-        Node* node = userAgent->firstChild();
+        Node* node = childrenOfType<MediaControls>(*root).first();
         ASSERT_WITH_SECURITY_IMPLICATION(!node || node->isMediaControls());
         return node;
     }

Modified: trunk/Source/WebCore/html/HTMLTextAreaElement.cpp (209129 => 209130)


--- trunk/Source/WebCore/html/HTMLTextAreaElement.cpp	2016-11-30 16:59:11 UTC (rev 209129)
+++ trunk/Source/WebCore/html/HTMLTextAreaElement.cpp	2016-11-30 17:03:48 UTC (rev 209130)
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (kn...@kde.org)
  *           (C) 1999 Antti Koivisto (koivi...@kde.org)
  *           (C) 2001 Dirk Mueller (muel...@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2004-2008, 2010, 2014, 2016 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (a...@nypop.com)
  * Copyright (C) 2007 Samuel Weinig (s...@webkit.org)
  *
@@ -30,6 +30,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "Editor.h"
+#include "ElementChildIterator.h"
 #include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
@@ -328,7 +329,11 @@
 
 TextControlInnerTextElement* HTMLTextAreaElement::innerTextElement() const
 {
-    return downcast<TextControlInnerTextElement>(userAgentShadowRoot()->firstChild());
+    ShadowRoot* root = userAgentShadowRoot();
+    if (!root)
+        return nullptr;
+    
+    return childrenOfType<TextControlInnerTextElement>(*root).first();
 }
 
 void HTMLTextAreaElement::rendererWillBeDestroyed()

Modified: trunk/Source/WebCore/html/RangeInputType.cpp (209129 => 209130)


--- trunk/Source/WebCore/html/RangeInputType.cpp	2016-11-30 16:59:11 UTC (rev 209129)
+++ trunk/Source/WebCore/html/RangeInputType.cpp	2016-11-30 17:03:48 UTC (rev 209130)
@@ -33,6 +33,7 @@
 #include "RangeInputType.h"
 
 #include "AXObjectCache.h"
+#include "ElementChildIterator.h"
 #include "EventNames.h"
 #include "HTMLInputElement.h"
 #include "HTMLParserIdioms.h"
@@ -267,7 +268,15 @@
     ASSERT(element().userAgentShadowRoot()->firstChild()->isHTMLElement());
     ASSERT(element().userAgentShadowRoot()->firstChild()->firstChild()); // track
 
-    return downcast<HTMLElement>(element().userAgentShadowRoot()->firstChild()->firstChild());
+    ShadowRoot* root = element().userAgentShadowRoot();
+    if (!root)
+        return nullptr;
+    
+    auto* container = childrenOfType<SliderContainerElement>(*root).first();
+    if (!container)
+        return nullptr;
+
+    return childrenOfType<HTMLElement>(*container).first();
 }
 
 SliderThumbElement& RangeInputType::typedSliderThumbElement() const

Modified: trunk/Source/WebCore/html/shadow/SliderThumbElement.h (209129 => 209130)


--- trunk/Source/WebCore/html/shadow/SliderThumbElement.h	2016-11-30 16:59:11 UTC (rev 209129)
+++ trunk/Source/WebCore/html/shadow/SliderThumbElement.h	2016-11-30 17:03:48 UTC (rev 209130)
@@ -136,8 +136,14 @@
     RenderPtr<RenderElement> createElementRenderer(RenderStyle&&, const RenderTreePosition&) override;
     std::optional<ElementStyle> resolveCustomStyle(const RenderStyle&, const RenderStyle*) override;
     const AtomicString& shadowPseudoId() const override;
+    bool isSliderContainerElement() const override { return true; }
 
     AtomicString m_shadowPseudoId;
 };
 
 } // namespace WebCore
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(WebCore::SliderContainerElement)
+    static bool isType(const WebCore::Element& element) { return element.isSliderContainerElement(); }
+    static bool isType(const WebCore::Node& node) { return is<WebCore::Element>(node) && isType(downcast<WebCore::Element>(node)); }
+SPECIALIZE_TYPE_TRAITS_END()

Modified: trunk/Source/WebCore/svg/SVGUseElement.cpp (209129 => 209130)


--- trunk/Source/WebCore/svg/SVGUseElement.cpp	2016-11-30 16:59:11 UTC (rev 209129)
+++ trunk/Source/WebCore/svg/SVGUseElement.cpp	2016-11-30 17:03:48 UTC (rev 209130)
@@ -261,7 +261,7 @@
     auto* root = userAgentShadowRoot();
     if (!root)
         return nullptr;
-    return downcast<SVGElement>(root->firstChild());
+    return childrenOfType<SVGElement>(*root).first();
 }
 
 RenderPtr<RenderElement> SVGUseElement::createElementRenderer(RenderStyle&& style, const RenderTreePosition&)
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to