Attachment 340034 Details for Bug 185493 – Fixes the bug

[patch] Fixes the bug

bug-185493-20180509144954.patch (text/plain), 4.76 KB, created by Ryosuke Niwa on 2018-05-09 14:49:55 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Ryosuke Niwa

Created: 2018-05-09 14:49:55 PDT

Size: 4.76 KB

patch

obsolete

>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 231596)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,20 @@
>+2018-05-09  Ryosuke Niwa  <rniwa@webkit.org>
>+
>+        Release assert in TreeScopeOrderedMap::remove via HTMLImageElement::removedFromAncestor
>+        https://bugs.webkit.org/show_bug.cgi?id=185493
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Fixed the bug that HTMLImageElement::removedFromAncestor and HTMLMapElement::removedFromAncestor
>+        were calling removeImageElementByUsemap on the document instead of the shadow tree from which it was removed.
>+
>+        Test: fast/images/imagemap-in-shadow-tree-removed.html
>+
>+        * html/HTMLImageElement.cpp:
>+        (WebCore::HTMLImageElement::removedFromAncestor):
>+        * html/HTMLMapElement.cpp:
>+        (WebCore::HTMLMapElement::removedFromAncestor):
>+
> 2018-05-09  Justin Fan  <justin_fan@apple.com>
> 
>         Hooked up ASTC support in WebGL; requires OpenGL ES 3 context to work. 
>Index: Source/WebCore/html/HTMLImageElement.cpp
>===================================================================
>--- Source/WebCore/html/HTMLImageElement.cpp	(revision 231579)
>+++ Source/WebCore/html/HTMLImageElement.cpp	(working copy)
>@@ -342,7 +342,7 @@ void HTMLImageElement::removedFromAncest
>         m_form->removeImgElement(this);
> 
>     if (removalType.disconnectedFromDocument && !m_parsedUsemap.isNull())
>-        treeScope().removeImageElementByUsemap(*m_parsedUsemap.impl(), *this);
>+        oldParentOfRemovedTree.treeScope().removeImageElementByUsemap(*m_parsedUsemap.impl(), *this);
> 
>     if (is<HTMLPictureElement>(parentNode()))
>         setPictureElement(nullptr);
>Index: Source/WebCore/html/HTMLMapElement.cpp
>===================================================================
>--- Source/WebCore/html/HTMLMapElement.cpp	(revision 231579)
>+++ Source/WebCore/html/HTMLMapElement.cpp	(working copy)
>@@ -126,7 +126,7 @@ Node::InsertedIntoAncestorResult HTMLMap
> void HTMLMapElement::removedFromAncestor(RemovalType removalType, ContainerNode& oldParentOfRemovedTree)
> {
>     if (removalType.disconnectedFromDocument)
>-        treeScope().removeImageMap(*this);
>+        oldParentOfRemovedTree.treeScope().removeImageMap(*this);
>     HTMLElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
> }
> 
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 231579)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,15 @@
>+2018-05-09  Ryosuke Niwa  <rniwa@webkit.org>
>+
>+        Release assert in TreeScopeOrderedMap::remove via HTMLImageElement::removedFromAncestor
>+        https://bugs.webkit.org/show_bug.cgi?id=185493
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Added a regression test.
>+
>+        * fast/images/imagemap-in-shadow-tree-removed-expected.txt: Added.
>+        * fast/images/imagemap-in-shadow-tree-removed.html: Added.
>+
> 2018-05-09  Youenn Fablet  <youenn@apple.com>
> 
>         Unflake some additional AppCache tests
>Index: LayoutTests/fast/images/imagemap-in-shadow-tree-removed-expected.txt
>===================================================================
>--- LayoutTests/fast/images/imagemap-in-shadow-tree-removed-expected.txt	(nonexistent)
>+++ LayoutTests/fast/images/imagemap-in-shadow-tree-removed-expected.txt	(working copy)
>@@ -0,0 +1,4 @@
>+This tests removing an image map area inside a shadow tree. WebKit should not hit any assertions.
>+
>+PASS
>+
>Index: LayoutTests/fast/images/imagemap-in-shadow-tree-removed.html
>===================================================================
>--- LayoutTests/fast/images/imagemap-in-shadow-tree-removed.html	(nonexistent)
>+++ LayoutTests/fast/images/imagemap-in-shadow-tree-removed.html	(working copy)
>@@ -0,0 +1,35 @@
>+<!DOCTYPE html>
>+<html>
>+<body>
>+<script src="../../resources/ui-helper.js"></script>
>+<p>This tests removing an image map area inside a shadow tree. WebKit should not hit any assertions.</p>
>+<div id="result"></div>
>+<script>
>+
>+if (window.testRunner)
>+    testRunner.dumpAsText();
>+
>+const host = document.createElement('div');
>+document.body.appendChild(host);
>+
>+const shadowRoot = host.attachShadow({mode: 'closed'});
>+shadowRoot.innerHTML = `<div></div>`;
>+
>+const container = document.createElement('div');
>+document.body.appendChild(container);
>+container.innerHTML = `<img src="resources/green-400x400.png" width="400" height="400" usemap="#imagemap" onload="startTest()">
>+<map name="imagemap">
>+    <area id="area" shape="rect" coords="0,0,200,200" href="#" tabindex="0">
>+</map>`;
>+
>+function startTest()
>+{
>+    shadowRoot.firstChild.appendChild(container);
>+    container.remove();
>+    document.getElementById('result').textContent = 'PASS';
>+}
>+
>+</script>
>+</body>
>+</head>
>+</html>

Flags:

bfulgham: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 185493: 340034