If you click on the "Q" label (an anchor), the onclick="toggleInto(event, 'Index_Q_div')" starts a javascript to retrieve a list of names and insert them into the document. On each name there is again an onclick="toggleInto(event, 'uniqueId')" specified, but now the javascript does _not_ get control and the content gets displayed on a separate page. It works as expected in Firefox 3.0.8 and Opera 9.64.
Created attachment 29391 [details] test case
See also: bug 23318.
*** Bug 29533 has been marked as a duplicate of this bug. ***
Created attachment 40092 [details] proposed fix
CC'ing Adam, since this slightly touches XSSAuditor, and could be security sensitive in general.
This patch appears to largely undo a recent patch by Sam. Maybe I'm confusing two things.
(In reply to comment #6) > This patch appears to largely undo a recent patch by Sam. Maybe I'm confusing > two things. This isn't actually touching the same code, I added global objects to some other callback objects, but it is a very similar case. I need to think about when/if passing the scriptExecutionContext() won't work where storing a globalObject would.
(In reply to comment #7) > (In reply to comment #6) > > This patch appears to largely undo a recent patch by Sam. Maybe I'm confusing > > two things. > > This isn't actually touching the same code, I added global objects to some > other callback objects, but it is a very similar case. I need to think about > when/if passing the scriptExecutionContext() won't work where storing a > globalObject would. After thinking this over, I think this is the right direction to go and we should convert our other callback objects to use the same technique. r=me as well.
Committed revision 48767.
Fix reverted in r48778, because it broke Windows build, and we don't yet know how to fix it.
Comment on attachment 40092 [details] proposed fix Sad. Marking r- since this was reverted. Hopefully a fix can be found soon! :)
WebCore/ChangeLog has been corrupted while reverting. Restored. Committing to http://svn.webkit.org/repository/webkit/trunk ... M WebCore/ChangeLog Committed r48800
Created attachment 40278 [details] now with Windows build fix
Committed revision 48884.
Build fix in r48887.
Mass moving XML DOM bugs to the "DOM" Component.