wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 761120 - Disallow inserting a text node as child of a document; r=bz

Browse Source
This commit is contained in:
Ms2ger 2012-06-06 09:42:06 +02:00
parent 603e690fa0
commit a2f3518cf1
3 changed files with 56 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
content/base/src/nsGenericElement.cpp
View File

@ -3960,25 +3960,24 @@ nsGenericElement::SaveSubtreeState()
// latter case it may be null.
static
bool IsAllowedAsChild(nsIContent* aNewChild, nsINode* aParent,
bool aIsReplace, nsINode* aRefChild)
bool aIsReplace, nsINode* aRefChild)
{
NS_PRECONDITION(aNewChild, "Must have new child");
NS_PRECONDITION(!aIsReplace || aRefChild,
"Must have ref content for replace");
NS_PRECONDITION(aParent->IsNodeOfType(nsINode::eDOCUMENT) ||
aParent->IsNodeOfType(nsINode::eDOCUMENT_FRAGMENT) ||
aParent->IsElement(),
"Nodes that are not documents, document fragments or "
"elements can't be parents!");
MOZ_ASSERT(aNewChild, "Must have new child");
MOZ_ASSERT_IF(aIsReplace, aRefChild);
MOZ_ASSERT(aParent);
MOZ_ASSERT(aParent->IsNodeOfType(nsINode::eDOCUMENT) ||
aParent->IsNodeOfType(nsINode::eDOCUMENT_FRAGMENT) ||
aParent->IsElement(),
"Nodes that are not documents, document fragments or elements "
"can't be parents!");
// A common case is that aNewChild has no kids, in which case
// aParent can't be a descendant of aNewChild unless they're
// actually equal to each other. Fast-path that case, since aParent
// could be pretty deep in the DOM tree.
if (aParent &&
(aNewChild == aParent ||
(aNewChild->GetFirstChild() &&
nsContentUtils::ContentIsDescendantOf(aParent, aNewChild)))) {
if (aNewChild == aParent ||
(aNewChild->GetFirstChild() &&
nsContentUtils::ContentIsDescendantOf(aParent, aNewChild))) {
return false;
}
@ -3991,8 +3990,8 @@ bool IsAllowedAsChild(nsIContent* aNewChild, nsINode* aParent,
case nsIDOMNode::TEXT_NODE :
case nsIDOMNode::CDATA_SECTION_NODE :
case nsIDOMNode::ENTITY_REFERENCE_NODE :
// Only allowed under elements
return aParent != nsnull;
// Allowed under Elements and DocumentFragments
return aParent->NodeType() != nsIDOMNode::DOCUMENT_NODE;
case nsIDOMNode::ELEMENT_NODE :
{
if (!aParent->IsNodeOfType(nsINode::eDOCUMENT)) {

1
content/base/test/Makefile.in
View File

@ -549,6 +549,7 @@ _TEST_FILES2 = \
test_bug433662.html \
test_bug749367.html \
test_bug753278.html \
test_bug761120.html \
test_XHR_onuploadprogress.html \
$(NULL)

41
content/base/test/test_bug761120.html Normal file
View File

@ -0,0 +1,41 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=761120
-->
<head>
<meta charset="utf-8">
<title>Test for Bug 761120</title>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=761120">Mozilla Bug 761120</a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
<script type="application/javascript">
/** Test for Bug 761120 **/
var doc = document.implementation.createHTMLDocument("title");
try {
doc.appendChild(doc.createTextNode("text"));
ok(false, "Didn't throw");
} catch (e) {
is(e.name, "HierarchyRequestError");
}
var el = document.createElement("div");
var text = document.createTextNode("text");
el.appendChild(text);
is(el.firstChild, text);
var df = document.createDocumentFragment();
text = document.createTextNode("text");
df.appendChild(text);
is(df.firstChild, text);
</script>
</pre>
</body>
</html>