Bug 124145

Summary: REGRESSION (r158774): Iteration over element children is broken
Product: WebKit Reporter: yannick.poirier
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: ap, commit-queue, esprehn+autocc, gyuyoung.kim, kling, koivisto, rniwa
Priority: P1 Keywords: InRadar, Regression
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
patch andersca: review+

Description yannick.poirier 2013-11-11 06:31:29 PST
The following test fails with the error
line 14:41 : TypeError: null is not an object (evaluating 'frame.children[i].firstChild.innerHTML = "test"')
The DOM tree seems to be corrupted after an innerHTML.

<html>
<head></head>
<body>
    <div id="frame">
        <div><div></div></div>
        <div><div></div></div>
        <div><div></div></div>
        <div><div></div></div>
        <div><div></div></div>
    </div>
    <script type="text/javascript">
        frame = document.getElementById("frame");
        for (var i = 0; i < frame.children.length; i++)
            frame.children[i].firstChild.innerHTML = "test";
    </script>
</body>
</html>
Comment 1 Alexey Proskuryakov 2013-11-11 09:35:43 PST
<rdar://problem/15437790>
Comment 2 Antti Koivisto 2013-11-17 12:51:16 PST
Created attachment 217151 [details]
patch
Comment 3 Anders Carlsson 2013-11-17 12:53:30 PST
Comment on attachment 217151 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=217151&action=review

> Source/WebCore/ChangeLog:12
> +        Reducation by yannick.poirier@inverto.tv.

Reduction?
Comment 4 Antti Koivisto 2013-11-17 13:35:26 PST
https://trac.webkit.org/r159389
Comment 5 Antti Koivisto 2013-11-17 13:36:17 PST
Thanks for the bug report and good reduction Yannick!