Bug 87454 – createContextualFragment and insertAdjacentHTML should throw syntax error

• Component: DOM
• Status: RESOLVED FIXED

[Ryosuke Niwa]

Right now, createContextualFragment throws NOT_SUPPORTED_ERR and insertAdjacentHTML doesn't throw any errors.

We should throw SYNTAX_ERR to be consistent with the spec and Firefox.
http://html5.org/specs/dom-parsing.html#parsing
http://www.whatwg.org/specs/web-apps/current-work/multipage/the-xhtml-syntax.html#xml-fragment-parsing-algorithm

[Ryosuke Niwa]

Created attachment 143960 [details]
Fixes the bug

[Ryosuke Niwa]

Created attachment 143962 [details]
Fixed Qt build

[Ryosuke Niwa]

Comment on attachment 143962 [details]
Fixed Qt build

View in context: https://bugs.webkit.org/attachment.cgi?id=143962&action=review

> Source/WebCore/editing/markup.h:56
> -    PassRefPtr<DocumentFragment> createContextualFragment(const String&, Element*,  FragmentScriptingPermission);
> +    PassRefPtr<DocumentFragment> createContextualFragment(const String&, Element*, FragmentScriptingPermission, ExceptionCode&);

Oops, I meant to change Element* to HTMLElement*. Will do once I get a review.

[WebKit Review Bot]

Comment on attachment 143962 [details]
Fixed Qt build

Attachment 143962 [details] did not pass chromium-ews (chromium-xvfb):
Output: http://queues.webkit.org/results/12800415

New failing tests:
fast/parser/xhtml-innerhtml-null-byte.xhtml
fast/innerHTML/innerHTML-changing-document-properties.xhtml
fast/parser/xhtml-innerhtml-null-byte-first.xhtml

[WebKit Review Bot]

Created attachment 143981 [details]
Archive of layout-test-results from ec2-cr-linux-02

The attached test failures were seen while running run-webkit-tests on the chromium-ews.
Bot: ec2-cr-linux-02  Port: <class 'webkitpy.common.config.ports.ChromiumXVFBPort'>  Platform: Linux-2.6.35-28-virtual-x86_64-with-Ubuntu-10.10-maverick

[Ryosuke Niwa]

Created attachment 143992 [details]
Fixed tests

[Alexey Proskuryakov]

Comment on attachment 143992 [details]
Fixed tests

View in context: https://bugs.webkit.org/attachment.cgi?id=143992&action=review

Does IE support insertAdjacentHTML? Does it raise exceptions?

> Source/WebCore/editing/markup.cpp:669
> +    ExceptionCode ignoredEC;
> +    RefPtr<DocumentFragment> fragment = createContextualFragment(markup, fakeBody.get(), scriptingPermission, ignoredEC);

Seems worth commenting why it's ignored.

> Source/WebKit/qt/Api/qwebelement.cpp:1063
> +    RefPtr<DocumentFragment> fragment =  createContextualFragment(markup, toHTMLElement(m_element), AllowScriptingContent, exception);
>  
>      if (m_element->hasChildNodes())
>          m_element->insertBefore(fragment, m_element->firstChild(), exception);

What happens if this raises an exception? Looks like a crash due to null fragment to me.

> Source/WebKit/qt/Api/qwebelement.cpp:1113
>      ExceptionCode exception = 0;
> +    RefPtr<DocumentFragment> fragment = createContextualFragment(markup, toHTMLElement(parent), AllowScriptingContent, exception);
> +
>      parent->insertBefore(fragment, m_element, exception);

Ditto.

> Source/WebKit/qt/Api/qwebelement.cpp:1164
> +    RefPtr<DocumentFragment> fragment = createContextualFragment(markup, toHTMLElement(parent), AllowScriptingContent, exception);
> +
>      if (!m_element->nextSibling())
>          parent->appendChild(fragment, exception);

Ditto.

[Ryosuke Niwa]

(In reply to comment #7)
> (From update of attachment 143992 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=143992&action=review
> 
> Does IE support insertAdjacentHTML? Does it raise exceptions?

IE doesn't throw exceptions for all cases tested here. I'm making insertAdjacentHTML throw for consistency with other APIs. (e.g. it's surprising if innerHTML throws and insertAdjacentHTML doesn't throw for the same markup). Given that insertAdjacentHTML isn't a particularly popular API and that this only happens in XHTML document, I don't expect there to be any compat. issues.

> > Source/WebCore/editing/markup.cpp:669
> > +    ExceptionCode ignoredEC;
> > +    RefPtr<DocumentFragment> fragment = createContextualFragment(markup, fakeBody.get(), scriptingPermission, ignoredEC);
> 
> Seems worth commenting why it's ignored.

createFragmentFromMarkup is only used for copy & paste purposes (and moving paragraphs). I'm intending to rename this function to make it clear why ignoring the exception makes sense. But do you have a suggestion on what kind of comment we should add?

> > Source/WebKit/qt/Api/qwebelement.cpp:1063
> > +    RefPtr<DocumentFragment> fragment =  createContextualFragment(markup, toHTMLElement(m_element), AllowScriptingContent, exception);
> >  
> >      if (m_element->hasChildNodes())
> >          m_element->insertBefore(fragment, m_element->firstChild(), exception);
> 
> What happens if this raises an exception? Looks like a crash due to null fragment to me.

Yeah, but I'm not changing the behavior here. We have always returned null fragments when XML parser returned null. Folks from the Qt port needs to address this issue.

[Alexey Proskuryakov]

> insertAdjacentHTML isn't a particularly popular API and that this only happens in XHTML document

It does seem that the general rule of sticking to majority behavior is weaker here, and and consistency arguments feel a bit stronger than usual.

[Eric Seidel (no email)]

Comment on attachment 143992 [details]
Fixed tests

View in context: https://bugs.webkit.org/attachment.cgi?id=143992&action=review

> Source/WebCore/ChangeLog:8
> +        Fixed the bug and reduced the code duplication.

Adding an exception is always scary.  Can you document here what other browsers do, and why we're making this change?  Is there a sepc which says we should throw here?

[Ryosuke Niwa]

(In reply to comment #10)
> (From update of attachment 143992 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=143992&action=review
> 
> > Source/WebCore/ChangeLog:8
> > +        Fixed the bug and reduced the code duplication.
> 
> Adding an exception is always scary.  Can you document here what other browsers do, and why we're making this change?  Is there a sepc which says we should throw here?

Yes, see my original bug report:

Right now, createContextualFragment throws NOT_SUPPORTED_ERR and insertAdjacentHTML doesn't throw any errors.

We should throw SYNTAX_ERR to be consistent with the spec and Firefox.
http://html5.org/specs/dom-parsing.html#parsing
http://www.whatwg.org/specs/web-apps/current-work/multipage/the-xhtml-syntax.html#xml-fragment-parsing-algorithm

I can include that in the change log if you want.

[Ryosuke Niwa]

Created attachment 144143 [details]
Address comments while waiting for a review

[Darin Adler]

Comment on attachment 144143 [details]
Address comments while waiting for a review

View in context: https://bugs.webkit.org/attachment.cgi?id=144143&action=review

> Source/WebCore/editing/markup.cpp:1055
> +PassRefPtr<DocumentFragment> createContextualFragment(const String& markup, HTMLElement* htmlElement, FragmentScriptingPermission scriptingPermission, ExceptionCode& ec)

I don’t think we should rename the element argument even though we are changing the type.

[Ryosuke Niwa]

Comment on attachment 144143 [details]
Address comments while waiting for a review

View in context: https://bugs.webkit.org/attachment.cgi?id=144143&action=review

>> Source/WebCore/editing/markup.cpp:1055
>> +PassRefPtr<DocumentFragment> createContextualFragment(const String& markup, HTMLElement* htmlElement, FragmentScriptingPermission scriptingPermission, ExceptionCode& ec)
> 
> I don’t think we should rename the element argument even though we are changing the type.

Okay. It'll be a bit invasive but no problem.

[Ryosuke Niwa]

Committed r118570: <http://trac.webkit.org/changeset/118570>