Bug 149418 – HTMLOutputElement.htmlFor should be settable

• Component: DOM
• Status: RESOLVED FIXED

[Chris Dumez]

HTMLOutputElement.htmlFor should be settable as per the specification:
https://html.spec.whatwg.org/multipage/forms.html#the-output-element

It is supposed to call DOMSettableTokenList.setValue() with the input String.

[Chris Dumez]

Created attachment 261758 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 261758 [details]
Patch

Clearing flags on attachment: 261758

Committed r190134: <http://trac.webkit.org/changeset/190134>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Chris Dumez]

May have caused a crash on the bots:
Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       EXC_I386_GPFLT

Application Specific Information:
CRASHING TEST: fast/dom/HTMLScriptElement/script-set-src.html

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x000000011044b0c7 WebCore::JSDOMTokenListOwner::isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown>, void*, JSC::SlotVisitor&) + 39
1   com.apple.JavaScriptCore      	0x000000010ee14774 JSC::WeakBlock::visit(JSC::HeapRootVisitor&) + 212 (WeakBlock.cpp:123)
2   com.apple.JavaScriptCore      	0x000000010ecb97cb JSC::VisitWeakSet::ReturnType JSC::MarkedSpace::forEachBlock<JSC::VisitWeakSet>(JSC::VisitWeakSet&) + 651 (MarkedSpace.h:242)
3   com.apple.JavaScriptCore      	0x000000010ecb8b21 JSC::MarkedSpace::visitWeakSets(JSC::HeapRootVisitor&) + 145 (MarkedSpace.cpp:156)
4   com.apple.JavaScriptCore      	0x000000010eacc59a JSC::Heap::visitWeakHandles(JSC::HeapRootVisitor&) + 106 (Heap.cpp:484)
5   com.apple.JavaScriptCore      	0x000000010eacbd5a JSC::Heap::markRoots(double, void*, void*, int (&) [37]) + 1018 (Heap.cpp:563)
6   com.apple.JavaScriptCore      	0x000000010eacdccd JSC::Heap::collectImpl(JSC::HeapOperation, void*, void*, int (&) [37]) + 733 (Heap.cpp:1011)
7   com.apple.JavaScriptCore      	0x000000010eacd9bd JSC::Heap::collect(JSC::HeapOperation) + 237 (Heap.cpp:962)
8   com.apple.JavaScriptCore      	0x000000010e82f89d JSC::GCActivityCallback::doWork() + 125 (GCActivityCallback.cpp:81)
9   com.apple.JavaScriptCore      	0x000000010ead341a JSC::HeapTimer::timerDidFire(__CFRunLoopTimer*, void*) + 186 (HeapTimer.cpp:101)
10  com.apple.CoreFoundation      	0x00007fff87e7c2e4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
11  com.apple.CoreFoundation      	0x00007fff87e7bf73 __CFRunLoopDoTimer + 1059
12  com.apple.CoreFoundation      	0x00007fff87eef53d __CFRunLoopDoTimers + 301
13  com.apple.CoreFoundation      	0x00007fff87e37608 __CFRunLoopRun + 2024
14  com.apple.CoreFoundation      	0x00007fff87e36bd8 CFRunLoopRunSpecific + 296
15  DumpRenderTree                	0x000000010e60846f runTest(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 2144 (DumpRenderTree.mm:2031)
16  DumpRenderTree                	0x000000010e6079dc dumpRenderTree(int, char const**) + 3053 (DumpRenderTree.mm:1288)
17  DumpRenderTree                	0x000000010e608f9f DumpRenderTreeMain(int, char const**) + 1400 (DumpRenderTree.mm:1424)
18  libdyld.dylib                 	0x00007fff886f35c9 start + 1

I am looking into it a bit but it looks non-trivial so I may simply roll out for now.

[WebKit Commit Bot]

Re-opened since this is blocked by bug 149481

[Chris Dumez]

Created attachment 261790 [details]
Patch

[Chris Dumez]

Changes since the previous patch that was rolled out:
- AttributeDOMTokenList now refs/unrefs its associated Element again. This is needed because DOMTokenList is using [GenerateIsReachable=ImplElementRoot]. This is what was causing the GC crashes.
- DOMSettableTokenList is no longer RefCounted. This is no longer needed as all call sites now use AttributeDOMTokenList and AttributeDOMTokenList handles its own ref-counting.
- Update HTMLLinkElement.sizes to use AttributeDOMTokenList instead of DOMSettableTokenList as it has an associated attribute (sizes). This fixes a bug as a result as the previous implementation would fail to update the associated sizes attribute value whenever HTMLLinkElement.sizes property was set by the JavaScript. I added a new layout test to cover this.

[WebKit Commit Bot]

Comment on attachment 261790 [details]
Patch

Clearing flags on attachment: 261790

Committed r190168: <http://trac.webkit.org/changeset/190168>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Brent Fulgham]

This broke the Windows build:

WebCore.lib(AttributeDOMTokenList.obj) : error LNK2001: unresolved external symbol "public: virtual void __thiscall WebCore::DOMSettableTokenList::ref(void)" (?ref@DOMSettableTokenList@WebCore@@UAEXXZ) [C:\cygwin\home\buildbot\slave\win-release\build\WebKitBuild\Release\Source\WebKit\WebKit.vcxproj]
WebCore.lib(AttributeDOMTokenList.obj) : error LNK2001: unresolved external symbol "public: virtual void __thiscall WebCore::DOMSettableTokenList::deref(void)" (?deref@DOMSettableTokenList@WebCore@@UAEXXZ) [C:\cygwin\home\buildbot\slave\win-release\build\WebKitBuild\Release\Source\WebKit\WebKit.vcxproj]

Please fix!

[WebKit Commit Bot]

Re-opened since this is blocked by bug 149502

[Chris Dumez]

Comment on attachment 261790 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=261790&action=review

> Source/WebCore/html/DOMSettableTokenList.h:45
>      virtual void ref() override;

Ah, I forgot to drop those.

[Chris Dumez]

Created attachment 261829 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 261829 [details]
Patch

Rejecting attachment 261829 [details] from commit-queue.

Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-03', 'validate-changelog', '--check-oops', '--non-interactive', 261829, '--port=mac']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit

ChangeLog entry in LayoutTests/ChangeLog contains OOPS!.

Full output: http://webkit-queues.webkit.org/results/203945

[Chris Dumez]

Committed r190189: <http://trac.webkit.org/changeset/190189>