Summary: | ChildNode.replaceWith() without argument should replace the node with an empty DocumentFragment | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Chris Dumez <cdumez> | ||||
Component: | DOM | Assignee: | Chris Dumez <cdumez> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | ap, commit-queue, esprehn+autocc, kangil.han, rniwa, webkit-bug-importer | ||||
Priority: | P2 | Keywords: | InRadar, WebExposed | ||||
Version: | Other | ||||||
Hardware: | Unspecified | ||||||
OS: | Unspecified | ||||||
Attachments: |
|
Description
Chris Dumez
2015-09-11 14:22:11 PDT
Created attachment 261016 [details]
Patch
Comment on attachment 261016 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=261016&action=review > Source/WebCore/ChangeLog:17 > + No new tests, already covered by existing test. Does this match behaviors of other browsers? (In reply to comment #3) > Comment on attachment 261016 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=261016&action=review > > > Source/WebCore/ChangeLog:17 > > + No new tests, already covered by existing test. > > Does this match behaviors of other browsers? Other browsers don't seem to implement replaceChild() yet. This is fairly recent I believe. (In reply to comment #4) > (In reply to comment #3) > > Comment on attachment 261016 [details] > > Patch > > > > View in context: > > https://bugs.webkit.org/attachment.cgi?id=261016&action=review > > > > > Source/WebCore/ChangeLog:17 > > > + No new tests, already covered by existing test. > > > > Does this match behaviors of other browsers? > > Other browsers don't seem to implement replaceChild() yet. This is fairly > recent I believe. replaceWith Comment on attachment 261016 [details] Patch Clearing flags on attachment: 261016 Committed r189653: <http://trac.webkit.org/changeset/189653> All reviewed patches have been landed. Closing bug. Comment on attachment 261016 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=261016&action=review > Source/WebCore/dom/Node.cpp:564 > + if (ec) > return; Not new, but this code is wrong. It’s not the caller’s responsibility to set ec to zero. The caller might not set it at all if it doesn’t plan to look at it. That means that ec might be non-zero when this function is called, and convertNodesOrStringsIntoNode might not touch it, so checking it is not right. Someone has to set ec to 0 if they are going to be checking it after the fact. So either Node::replaceWith or convertNodesOrStringsIntoNode needs to set ec to zero. This error seems to be repeated in multiple functions in this file. |