Bug 9504 – img tag rewritten by innerHTML doesn't use image map

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[Martin Hinks]

Test case #1: http://www.m-s-d.net/test.htm
Test case #2: http://www.m-s-d.net/test2.htm

Test case #1 shows a <span> tag being rewritten to contain an img tag with a usemap property and a <map> tag complete with areas. The write works when called from anything other than the function called when the imagemap is clicked. ie. it works on page load, but rewriting the tag via a function called from a click on the imagemap does not. After the rewrite called from within the imagemap click the zonemap does not work.

Test case #2 shows a <span> tag being rewritten to contain an img tag with a usemap property. The map is stored inline with the document after the span tag and not generated dynamically. In this case the zonemap never functions correctly.

These behaviours work as expected in Firefox and Internet Explorer (tested on WinXP SP2)

[Martin Hinks]

My mistake: test case #2 now shows a working example thereby showing that it is the rewrite of the map that causes the failure.

(In reply to comment #0)
> Test case #1: http://www.m-s-d.net/test.htm
> Test case #2: http://www.m-s-d.net/test2.htm
> 
> Test case #1 shows a <span> tag being rewritten to contain an img tag with a
> usemap property and a <map> tag complete with areas. The write works when
> called from anything other than the function called when the imagemap is
> clicked. ie. it works on page load, but rewriting the tag via a function called
> from a click on the imagemap does not. After the rewrite called from within the
> imagemap click the zonemap does not work.
> 
> Test case #2 shows a <span> tag being rewritten to contain an img tag with a
> usemap property. The map is stored inline with the document after the span tag
> and not generated dynamically. In this case the zonemap never functions
> correctly.
> 
> These behaviours work as expected in Firefox and Internet Explorer (tested on
> WinXP SP2)
> 

[Alexey Proskuryakov]

These test cases are now longer available. Reporter, could you please attach them to the bug?

[Martin Hinks]

> Test case #1: http://www.m-s-d.net/test.htm
> Test case #2: http://www.m-s-d.net/test2.htm
> 

Now at:

Test case #1: http://www.2bitpie.net/test.htm
Test case #2: http://www.2bitpie.net/test2.htm

[Alexey Proskuryakov]

These test cases are now longer available. Reporter, could you please attach
them to the bug?

[Alexey Proskuryakov]

*** Bug 26277 has been marked as a duplicate of this bug. ***

[Alexey Proskuryakov]

Bug 26277 has a test attached.

[Don Marks]

This problem can be worked around by renaming the old map to something inconsequential before it is replaced. 
For example: 
map.name = 'garbage';
mapparent.innerHTML = '<map name="mymap" ...';

[Don Marks]

I should add that even though this workaround seems to do the job, there is likely still a small memory leak of a reference to the now-deleted map being kept around.

If the map is renamed each time to a unique name, then an even bigger memory leak would likely occur.

[Alexey Proskuryakov]

See also: bug 19678.

[Alexey Proskuryakov]

*** Bug 19678 has been marked as a duplicate of this bug. ***

[Alexey Proskuryakov]

Created attachment 58314 [details]
proposed fix

I think that the workaround from comment 7 is a good one, there shouldn't be any memory leak.

[Alexey Proskuryakov]

Committed <http://trac.webkit.org/changeset/60937>.

[WebKit Review Bot]

http://trac.webkit.org/changeset/60937 might have broken SnowLeopard Intel Release (Tests)

[Alexey Proskuryakov]

Actually landed the test at last, <http://trac.webkit.org/changeset/63217>.