If an <object> is removed from the page while its fallback content is being used, Safari will automatically use fallback content when the object is re-inserted.

[Marc Hoyois]

Created attachment 65837 [details]
Simple Safari extension to reproduce the bug

Overview:
The bug happens in the following situation. There is an <object> element with fallback content on a page and Safari is currently using its fallback content. If one then removes the <object> element from the DOM tree and re-insert it later on, Safari automatically uses the fallback content again. In particular, no beforeload event is fired by the <object> element when it is re-inserted.

Steps to reproduce:
1. Install the attached extension. It has a simple injected script which does the following:

-> It listens to beforeload events, ignoring events not fired by <object> elements
-> When an object element is detected, it calls event.preventDefault() and, within a setTimeout of 3 seconds, replaces the <object> by a red <div>
-> Clicking on the red <div> restores the original <object> element

2. (requires Silverlight plugin installed) Navigate to http://www.silverlight.net (for example). This page has a single <object> element with an image as fallback content. Observe the alert box confirming that the object has fired a beforeload event.

3. Observe that Safari uses the fallback image, since the <object> has been blocked, and wait three seconds for the image to be replaced by a red rectangle.

4. Click on the red rectangle.

Expected result:
Upon re-insertion, the <object> should fire a beforeload event again (triggering an alert box as in step 2), and the Silverlight content should load normally.

Actual result:
No beforeload event is fired and the Silverlight content does not load. Instead, the fallback image is used.

Build and platform:
Tested in OS X 10.6 with both Safari 5.0.1 and Webkit 6533.17.8 r66130.

[Marc Hoyois]

Forgot to mention that the bug has a workaround:

Everything works as expected if, instead of restoring the original <object> element, one restores a clone element.cloneNode(true).

[Ahmad Saleem]

NPAPI and Webkit Plugins are not supported any more. Can this be marked as "RESOLVED WONTFIX"? Thanks!

[Ryosuke Niwa]

Hm... this is about object element's fallback content being displayed. It might be still relevant if the same issue reproduces with content type that's supported by object element like images and iframe.

[Ryosuke Niwa]

Created attachment 460509 [details]
Test case

The test prints PASS on Firefox but FAIL on Chrome & Safari.

[Ryosuke Niwa]

Pull request: https://github.com/WebKit/WebKit/pull/1836

[EWS]

Committed 251903@main (fdae8b382e05): <https://commits.webkit.org/251903@main>

Reviewed commits have been landed. Closing PR #1836 and removing active labels.

[Radar WebKit Bug Importer]

<rdar://problem/96037185>

[Alexey Proskuryakov]

Sorry for accidentally marking this as WONTFIX among other ones.

[Ryosuke Niwa]

(In reply to Alexey Proskuryakov from comment #8)
> Sorry for accidentally marking this as WONTFIX among other ones.

No problem. I figured you got confused with other bugs.