16585 - insertBefore, replaceChild, and appendChild should throw exception if given ancestor

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

DESCRIPTION:  If one attempts to use insertBefore() to insert an element's
ancestor as a child of that element (which would thus remove the ancestor from
the tree), a HIERARCHY_REQUEST_ERROR should be thrown.  This is currently not
happening, and, depending on which element you're using, this can cause a crash.

STEPS TO REPRODUCE:
 * load attached test case
 * hit test

ACTUAL RESULTS:
 * either crash or one line of red output

EXPECTED RESULTS:
 * green output

DOES NOT WORK CORRECTLY ON:
 * Linux, apprunner, 1999-10-15-11-M11

ADDITIONAL INFORMATION:
The test case that causes the crash does so by removing the body element from
the tree (or otherwise messing it up somehow).

I haven't tested this with appendChild(), etc., but there could be similar
problems.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: test case causing crash - basically h1.insertBefore(body, null)

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: test case failing to throw - basically h1.insertBefore(div,null)

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Note to myself:  I should update the test page once this is fixed by adding the
crash-causing test back in.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

replaceChild() causes the same problem.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I made the removing body node causing a crash a separate bug - bug 16585.

However, the first test case here shouldn't remove the body node.  It should
throw an exception.

Reducing severity to normal.

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The separate bug is bug 16586.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

appendChild() has the same problem.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Retitling and raising to major since this can really mess up the document
tree...

Comment 9

[vidur (gone)]

In an attempt to get my bug list in order again, marking all the bugs I have
currently as ASSIGNED.

Comment 10

[jst]

I've got a fix for this one, I'm working with Vidur on getting it checked in.

Comment 11

[Johnny Stenback (:jst)]

The fix for this is checked in, marking FIXED.

Comment 12

[Jan Carpenter]

Mass update of qa contact

Comment 13

[Prashant Desale]

QA contact Update

Comment 14

[Prashant Desale]

Updating QA contact to Shivakiran Tummala.

Comment 15

[Sivakiran Tummala]

verified on windows 2000 for build 2001-07-09-09 
marking as verified...