Bug 124145

Summary:

REGRESSION (r158774): Iteration over element children is broken

Product:

WebKit

Reporter:

yannick.poirier

Component:

DOM

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

ap, commit-queue, esprehn+autocc, gyuyoung.kim, kling, koivisto, rniwa

Priority:

Keywords:

InRadar, Regression

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
patch	andersca: review+

yannick.poirier

Reported 2013-11-11 06:31:29 PST

The following test fails with the error line 14:41 : TypeError: null is not an object (evaluating 'frame.children[i].firstChild.innerHTML = "test"') The DOM tree seems to be corrupted after an innerHTML. <html> <head></head> <body> <div id="frame"> <div><div></div></div> <div><div></div></div> <div><div></div></div> <div><div></div></div> <div><div></div></div> </div> <script type="text/javascript"> frame = document.getElementById("frame"); for (var i = 0; i < frame.children.length; i++) frame.children[i].firstChild.innerHTML = "test"; </script> </body> </html>

Attachments
patch (4.47 KB, patch) 2013-11-17 12:51 PST, Antti Koivisto	andersca: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Alexey Proskuryakov

Comment 1 2013-11-11 09:35:43 PST

<rdar://problem/15437790>

Antti Koivisto

Comment 2 2013-11-17 12:51:16 PST

Created attachment 217151 [details] patch

Anders Carlsson

Comment 3 2013-11-17 12:53:30 PST

Comment on attachment 217151 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=217151&action=review > Source/WebCore/ChangeLog:12 > + Reducation by yannick.poirier@inverto.tv. Reduction?

Antti Koivisto

Comment 4 2013-11-17 13:35:26 PST

https://trac.webkit.org/r159389

Antti Koivisto

Comment 5 2013-11-17 13:36:17 PST

Thanks for the bug report and good reduction Yannick!

Note You need to log in before you can comment on or make changes to this bug.