155504 - [FIXr]appendChild during document.write appends twice

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[Jesse Ruderman]

Click the URL link above, which is:
javascript:x=window.open(); x.document.write("foo");
x.document.body.appendChild(x.document.createTextNode("bar")); void 0

Result: foobarbar
Expected: foobar

Workaround: call document.close() before calling appendChild.

Works as expected in IE.

Comment 1

[Johnny Stenback (:jst)]

The DOM ends up being correct here, but we end up showing "bar" twice. Peterv,
the sink context stack n' all that must not be flushed/synced properly here,
wanna have a look?

Comment 2

[Jesse Ruderman]

Forgot to mention: selecting the second "bar" with the mouse actually selects
the first "bar".

Comment 3

[Johnny Stenback (:jst)]

Mass-reassigning bugs to [e-mail]

Comment 4

[Boris Zbarsky [:bzbarsky]]

So the problem, imo, is that the sink's treatment of notifications is just
totally whacked.  In particular, it assumes that if it's not in a script then
any notifications that are generated are caused by itself.  This is patently
incorrect if another window/frame accesses the DOM during parsing (as here).

(And why exactly does the sink not call BeginUpdate itself?  Not quite clear on
what the deal is there...)

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: This fixes this bug for me...

Comment 6

[Johnny Stenback (:jst)]

Comment on attachment 121069 [details] [diff] [review]
This fixes this bug for me...

Hmm, this seems strangely correct to me, but it still scares me a bit (knowing
how many regressions we've had from messing with this code over the years).

sr=jst

Comment 7

[Boris Zbarsky [:bzbarsky]]

taking

Comment 8

[Boris Zbarsky [:bzbarsky]]

Checked in.