RESOLVED FIXED 124145
REGRESSION (r158774): Iteration over element children is broken 
https://bugs.webkit.org/show_bug.cgi?id=124145
Summary REGRESSION (r158774): Iteration over element children is broken
yannick.poirier
Reported 2013-11-11 06:31:29 PST
The following test fails with the error line 14:41 : TypeError: null is not an object (evaluating 'frame.children[i].firstChild.innerHTML = "test"') The DOM tree seems to be corrupted after an innerHTML. <html> <head></head> <body> <div id="frame"> <div><div></div></div> <div><div></div></div> <div><div></div></div> <div><div></div></div> <div><div></div></div> </div> <script type="text/javascript"> frame = document.getElementById("frame"); for (var i = 0; i < frame.children.length; i++) frame.children[i].firstChild.innerHTML = "test"; </script> </body> </html>
Attachments
patch (4.47 KB, patch)
2013-11-17 12:51 PST, Antti Koivisto 		andersca: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 2013-11-11 09:35:43 PST
<rdar://problem/15437790>
Antti Koivisto
Comment 2 2013-11-17 12:51:16 PST
Created attachment 217151 [details] patch
Anders Carlsson
Comment 3 2013-11-17 12:53:30 PST
Comment on attachment 217151 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=217151&action=review > Source/WebCore/ChangeLog:12 > + Reducation by yannick.poirier@inverto.tv. Reduction?
Antti Koivisto
Comment 4 2013-11-17 13:35:26 PST
https://trac.webkit.org/r159389
Antti Koivisto
Comment 5 2013-11-17 13:36:17 PST
Thanks for the bug report and good reduction Yannick!
Note You need to log in before you can comment on or make changes to this bug.