Diff
Modified: branches/safari-536.28-branch/LayoutTests/ChangeLog (133479 => 133480)
--- branches/safari-536.28-branch/LayoutTests/ChangeLog 2012-11-05 16:14:27 UTC (rev 133479)
+++ branches/safari-536.28-branch/LayoutTests/ChangeLog 2012-11-05 16:16:51 UTC (rev 133480)
@@ -1,5 +1,32 @@
2012-11-05 Lucas Forschler <[email protected]>
+ Merge r125162
+
+ 2012-08-09 MORITA Hajime <[email protected]>
+
+ DOMCharacterDataModified should not be fired inside shadows
+ https://bugs.webkit.org/show_bug.cgi?id=93427
+
+ Reviewed by Ryosuke Niwa.
+
+ Added two tests. This also fixes existing test, which cover the wrong behavior.
+
+ * fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt: Added.
+ * fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html: Added.
+ * fast/events/dom-character-data-modified-textarea-crash.html:
+ - DOMCharacterDataModified shouldn't be fired in this case.
+ Fixed to allow test to terminate without the event.
+ Note that The event was fired by <textarea>, which is fixed by this change.
+ * fast/forms/textarea-and-mutation-events-appending-text-expected.txt: Added.
+ * fast/forms/textarea-and-mutation-events-appending-text.html: Added.
+ * svg/custom/tref-nested-events-crash.svg:
+ - DOMCharacterDataModified shouldn't be fired in this case.
+ Fixed to allow test to terminate without the event.
+ Note that The event was fired by SVGShadowText, which is just an implentation detail and
+ should not be exposed.
+
+2012-11-05 Lucas Forschler <[email protected]>
+
Merge r125147
2012-08-08 MORITA Hajime <[email protected]>
@@ -10953,3 +10980,4 @@
.
.
.
+.
Copied: branches/safari-536.28-branch/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt (from rev 125162, trunk/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt) (0 => 133480)
--- branches/safari-536.28-branch/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata-expected.txt 2012-11-05 16:16:51 UTC (rev 133480)
@@ -0,0 +1,11 @@
+Ensures that DOMCharacterDataModified isn't fired inside shadows.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS fired is false
+PASS div.innerHTML is 'Hello, World!'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/safari-536.28-branch/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html (from rev 125162, trunk/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html) (0 => 133480)
--- branches/safari-536.28-branch/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html 2012-11-05 16:16:51 UTC (rev 133480)
@@ -0,0 +1,25 @@
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<div id="host"></div>
+<script>
+description("Ensures that DOMCharacterDataModified isn't fired inside shadows.");
+var fired = false;
+var host = document.getElementById("host");
+var shadow = new WebKitShadowRoot(host);
+var div = document.createElement("div");
+div.addEventListener("DOMCharacterDataModified", function(evt) {
+ fired = true;
+}, false);
+
+shadow.appendChild(div);
+div.innerHTML = "Hello, ";
+div.firstChild.appendData("World!");
+shouldBeFalse("fired");
+shouldBe("div.innerHTML", "'Hello, World!'");
+</script>
+<script src=""
+</body>
+</html>
Modified: branches/safari-536.28-branch/LayoutTests/fast/events/dom-character-data-modified-textarea-crash.html (133479 => 133480)
--- branches/safari-536.28-branch/LayoutTests/fast/events/dom-character-data-modified-textarea-crash.html 2012-11-05 16:14:27 UTC (rev 133479)
+++ branches/safari-536.28-branch/LayoutTests/fast/events/dom-character-data-modified-textarea-crash.html 2012-11-05 16:16:51 UTC (rev 133480)
@@ -9,9 +9,9 @@
// * Mutation events should not be dispatched on this case. This bug is being tracked by webkit bug https://bugs.webkit.org/show_bug.cgi?id=87372
// * ... And Mutation events are no longer fired. See https://bugs.webkit.org/show_bug.cgi?id=93427.
// We would keep this test just for preventing regression.
-if (window.layoutTestController) {
- layoutTestController.dumpAsText();
- layoutTestController.waitUntilDone();
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
}
function attackAndFinish() {
@@ -20,8 +20,8 @@
document.execCommand("Delete");
document.body.offsetLeft;
document.body.innerHTML = 'Test passes if a DOMCharacterModified event on the textarea does not crash.';
- if (window.layoutTestController)
- layoutTestController.notifyDone();
+ if (window.testRunner)
+ testRunner.notifyDone();
}
document.addEventListener("DOMCharacterDataModified", attackAndFinish);
Copied: branches/safari-536.28-branch/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text-expected.txt (from rev 125162, trunk/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text-expected.txt) (0 => 133480)
--- branches/safari-536.28-branch/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text-expected.txt (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text-expected.txt 2012-11-05 16:16:51 UTC (rev 133480)
@@ -0,0 +1,10 @@
+Ensuring that mutation event with text modification on a textarea doesn't crash
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS unless crash.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/safari-536.28-branch/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text.html (from rev 125162, trunk/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text.html) (0 => 133480)
--- branches/safari-536.28-branch/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text.html (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/forms/textarea-and-mutation-events-appending-text.html 2012-11-05 16:16:51 UTC (rev 133480)
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script>
+description("Ensuring that mutation event with text modification on a textarea doesn't crash");
+
+span = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+document.implementation.createDocument("", "", null).adoptNode(span);
+
+textarea = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
+textarea.textContent = "Value";
+textarea.addEventListener("DOMCharacterDataModified", function (evt) { console.log(evt.target); textarea.textContent = ""; }, false);
+document.body.appendChild(textarea);
+
+text = document.createTextNode("Hello?");
+textarea.appendChild(text);
+span.appendChild(text);
+
+testPassed("unless crash.")
+</script>
+<script src=""
+</body>
Modified: branches/safari-536.28-branch/LayoutTests/svg/custom/tref-nested-events-crash.svg (133479 => 133480)
--- branches/safari-536.28-branch/LayoutTests/svg/custom/tref-nested-events-crash.svg 2012-11-05 16:14:27 UTC (rev 133479)
+++ branches/safari-536.28-branch/LayoutTests/svg/custom/tref-nested-events-crash.svg 2012-11-05 16:16:51 UTC (rev 133480)
@@ -31,6 +31,8 @@
setTimeout('testRunner.notifyDone()', 0);
}, false);
document.adoptNode(tspan);
+ if (window.testRunner)
+ setTimeout('testRunner.notifyDone()', 10);
}
</script>
</svg>
Modified: branches/safari-536.28-branch/Source/WebCore/ChangeLog (133479 => 133480)
--- branches/safari-536.28-branch/Source/WebCore/ChangeLog 2012-11-05 16:14:27 UTC (rev 133479)
+++ branches/safari-536.28-branch/Source/WebCore/ChangeLog 2012-11-05 16:16:51 UTC (rev 133480)
@@ -1,5 +1,27 @@
2012-11-05 Lucas Forschler <[email protected]>
+ Merge r125162
+
+ 2012-08-09 MORITA Hajime <[email protected]>
+
+ DOMCharacterDataModified should not be fired inside shadows
+ https://bugs.webkit.org/show_bug.cgi?id=93427
+
+ Reviewed by Ryosuke Niwa.
+
+ CharacterData::dispatchModifiedEvent() fires DOMCharacterDataModified event even if
+ the node is in shadow. But it shouldn't. Check dispatchChildInsertionEvents() and
+ dispatchChildRemovalEvents() to see how other MutationEvents are suppressed behind shadows.
+ This change follows the same path to suppress DOMCharacterDataModified.
+
+ Tests: fast/dom/shadow/suppress-mutation-events-in-shadow-characterdata.html
+ fast/forms/textarea-and-mutation-events-appending-text.html
+
+ * dom/CharacterData.cpp:
+ (WebCore::CharacterData::dispatchModifiedEvent):
+
+2012-11-05 Lucas Forschler <[email protected]>
+
Merge r125147
2012-08-08 MORITA Hajime <[email protected]>
@@ -206480,3 +206502,4 @@
.
.
.
+.
Modified: branches/safari-536.28-branch/Source/WebCore/dom/CharacterData.cpp (133479 => 133480)
--- branches/safari-536.28-branch/Source/WebCore/dom/CharacterData.cpp 2012-11-05 16:14:27 UTC (rev 133479)
+++ branches/safari-536.28-branch/Source/WebCore/dom/CharacterData.cpp 2012-11-05 16:16:51 UTC (rev 133480)
@@ -199,14 +199,16 @@
if (OwnPtr<MutationObserverInterestGroup> mutationRecipients = MutationObserverInterestGroup::createForCharacterDataMutation(this))
mutationRecipients->enqueueMutationRecord(MutationRecord::createCharacterData(this, oldData));
#endif
- if (parentNode())
- parentNode()->childrenChanged();
- if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER))
- dispatchEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, 0, oldData, m_data));
- dispatchSubtreeModifiedEvent();
+ if (!isInShadowTree()) {
+ if (parentNode())
+ parentNode()->childrenChanged();
+ if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER))
+ dispatchScopedEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, 0, oldData, m_data));
+ dispatchSubtreeModifiedEvent();
#if ENABLE(INSPECTOR)
- InspectorInstrumentation::characterDataModified(document(), this);
+ InspectorInstrumentation::characterDataModified(document(), this);
#endif
+ }
}
void CharacterData::checkCharDataOperation(unsigned offset, ExceptionCode& ec)
