Bug #:
Submitted by:
Reviewed by:
Bug #:
Submitted by:
Reviewed by:
Bug #:
Submitted by:
Reviewed by:
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@10581 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/fast/dom/replaceChild.html b/LayoutTests/fast/dom/replaceChild.html
new file mode 100644
index 0000000..3adabb2
--- /dev/null
+++ b/LayoutTests/fast/dom/replaceChild.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
+<title>main window</title>
+<style type="text/css" media="screen">
+ body{
+ margin:0px;
+ padding:0px;
+ background-color:#CCFFCC;
+ }
+ iframe#menu_import{
+ width: 150px;
+ height:150px;
+ border:1px solid #000;
+ }
+</style>
+<script language="javascript" type="text/javascript">
+ function loadMenu(m){
+ var w = document.getElementById("menu_content_area");
+ w.replaceChild(m, document.getElementById("menu_import"));
+ }
+</script>
+</head>
+
+<body>
+
+ <div id="menu_content_area"><iframe src="replaceChildHelper.html" id="menu_import" name="menu_import" ></iframe></div>
+
+</body>
+</html>
diff --git a/LayoutTests/fast/dom/replaceChildHelper.html b/LayoutTests/fast/dom/replaceChildHelper.html
new file mode 100644
index 0000000..46fba3e
--- /dev/null
+++ b/LayoutTests/fast/dom/replaceChildHelper.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
+<title>menu window</title>
+<script language="javascript" type="text/javascript">
+ function doLoad(){
+ if(window.parent){
+ var menu = document.getElementById("menu").cloneNode(true);
+ parent.loadMenu(menu);
+ }
+ }
+ window.onload = doLoad;
+</script>
+</head>
+ <div id="menu">
+ <div>test 1</div>
+ <div>test 2</div>
+ </div>
+<body>
+</body>
+</html>
+
diff --git a/WebCore/ChangeLog-2005-12-19 b/WebCore/ChangeLog-2005-12-19
index ce7017e..47c2ad4 100644
--- a/WebCore/ChangeLog-2005-12-19
+++ b/WebCore/ChangeLog-2005-12-19
@@ -1,3 +1,21 @@
+2005-09-20 Beth Dakin <bdakin@apple.com>
+
+ Reviewed by Hyatt
+
+ Test cases added: /fast/dom/replaceChild.html
+
+ This is a fix for <rdar://problem/4039660> crash replacing iframe
+ node with another node; test page posted on homepage.mac.com - nil
+ RenderArena. Basically the problem was that whenever a node was
+ passed to a new document, that node's document pointer was updated
+ to the new document, but the document pointers of its children were not.
+
+ * khtml/xml/dom_nodeimpl.cpp: Simple loop that recurses through children
+ changing their document pointers too.
+ (DOM::NodeImpl::checkAddChild):
+ * layout-tests/fast/dom/replaceChild.html: Added. New layout test.
+ * layout-tests/fast/dom/replaceChildHelper.html: Added. Helps new layout test.
+
2005-09-20 David Hyatt <hyatt@apple.com>
Meant to land this ages ago. Make radio buttons work dynamically
diff --git a/WebCore/khtml/xml/dom_nodeimpl.cpp b/WebCore/khtml/xml/dom_nodeimpl.cpp
index bc651b7..630673f 100644
--- a/WebCore/khtml/xml/dom_nodeimpl.cpp
+++ b/WebCore/khtml/xml/dom_nodeimpl.cpp
@@ -1138,10 +1138,12 @@
return;
}
- // only do this once we know there won't be an exception
+ // change the document pointer of newChild and all of its children to be the new document
if (shouldAdoptChild) {
- KJS::ScriptInterpreter::updateDOMNodeDocument(newChild, newChild->getDocument(), getDocument());
- newChild->setDocument(getDocument()->docPtr());
+ for (NodeImpl* node = newChild; node; node = node->traverseNextNode()) {
+ KJS::ScriptInterpreter::updateDOMNodeDocument(node, node->getDocument(), getDocument());
+ node->setDocument(getDocument()->docPtr());
+ }
}
}
