Closed Bug 1942352 Opened 1 month ago Closed 26 days ago

[wpt-sync] Sync PR 50148 - DOM: Fix moveBefore() disconnected iframe CHECK crash

Categories

(Core :: DOM: Core & HTML, task, P4)

Product:
Core
Component:
DOM: Core & HTML
Type:
task

Tracking

()

Status:
RESOLVED FIXED
Milestone:
136 Branch
Tracking Flags:
Tracking Status
firefox136 --- fixed

People

(Reporter: wpt-sync, Unassigned)

References

(
URL
)

Details

(Whiteboard: [wptsync downstream])

Sync web-platform-tests PR 50148 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/50148
Details from upstream follow.

Dominic Farolino <dom@chromium.org> wrote:

DOM: Fix moveBefore() disconnected iframe CHECK crash

This CL updates the iframe insertion/removal bookkeeping specific to
moveBefore() that was written with the assumption that all moved nodes
are always connected to the DOM. This code was not updated since
changes to moveBefore() preconditions were made. This CL fixes that,
and adds a test.

R=masonf, nrosenthal

Bug: 40150299, 389339248
Change-Id: I31f23d13f78af3eaa87d03ee7d5703ea97f363c5
Reviewed-on: https://chromium-review.googlesource.com/6182440
WPT-Export-Revision: fffcbdb05656b20279951df9c2294e4cd0e48c8a

PR 50148 applied with additional changes from upstream: 23f0e645a9c18244ed603e8707942703f2f0b983, d0faf28efdb60034f1b34ea91fa707899e3dbf52
Component: web-platform-tests → DOM: Core & HTML
Product: Testing → Core

CI Results

Ran 9 Firefox configurations based on mozilla-central, and Firefox, and Chrome on GitHub CI

Total 1 tests and 32 subtests

Status Summary

Firefox

OK : 1
PASS : 3
FAIL : 29

Chrome

CRASH: 1

Links

Gecko CI (Treeherder)
GitHub PR Head
GitHub PR Base

Details

New Tests That Don't Pass

  • /dom/nodes/moveBefore/tentative/Node-moveBefore.html [wpt.fyi]
    • If node is a host-including inclusive ancestor of parent, then throw a HierarchyRequestError DOMException.: FAIL
    • If node is not a DocumentFragment, DocumentType, Element, Text, ProcessingInstruction, or Comment node, then throw a HierarchyRequestError DOMException.: FAIL
    • If node is a Text node and parent is a document, then throw a HierarchyRequestError DOMException.: FAIL
    • If node is a doctype and parent is not a document, then throw a HierarchyRequestError DOMException.: FAIL
    • If node is a DocumentFragment with multiple elements and parent is a document, then throw a HierarchyRequestError DOMException.: FAIL
    • If node is a DocumentFragment with an element and parent is a document with another element, then throw a HierarchyRequestError DOMException.: FAIL
    • If node is an Element and parent is a document with another element, then throw a HierarchyRequestError DOMException.: FAIL
    • If node is a doctype and parent is a document with another doctype, then throw a HierarchyRequestError DOMException.: FAIL
    • If node is a doctype and parent is a document with an element, then throw a HierarchyRequestError DOMException.: FAIL
    • moveBefore() on disconnected parent throws a HierarchyRequestError: FAIL
    • moveBefore() with disconnected target node throws a HierarchyRequestError: FAIL
    • moveBefore() on a cross-document target node throws a HierarchyRequestError: FAIL
    • moveBefore() into a Document throws a HierarchyRequestError: FAIL
    • moveBefore() CharacterData into a Document: FAIL
    • moveBefore() with node being an inclusive ancestor of parent throws a HierarchyRequestError: FAIL
    • moveBefore() with a non-{Element, CharacterData} throws a HierarchyRequestError: FAIL
    • moveBefore with an Element or CharacterData succeeds: FAIL
    • moveBefore on a paragraph's Text node child: FAIL
    • moveBefore with reference child whose parent is NOT the destination parent (context node) throws a NotFoundError.: FAIL
    • moveBefore() returns undefined: FAIL
    • Moving a node before itself should not move the node: FAIL
    • Moving a node from a disconnected container to a disconnected new parent without a shared ancestor throws a HIERARCHY_REQUEST_ERR: FAIL
    • Moving a node from a disconnected container to a disconnected new parent in the same tree succeeds: FAIL
    • Moving a node from a disconnected container to a disconnected new parent in the same tree succeeds,also across shadow-roots: FAIL
    • Moving a node from disconnected->connected throws a HIERARCHY_REQUEST_ERR: FAIL
    • Moving a node from connected->disconnected throws a HIERARCHY_REQUEST_ERR: FAIL
    • No custom element callbacks are run during disconnected moveBefore(): FAIL
    • Invalid node hierarchy with null old parent does not crash: FAIL
    • Move disconnected iframe does not crash: FAIL
Pushed by wptsync@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/00690abc4037 [wpt PR 50148] - DOM: Fix moveBefore() disconnected iframe CHECK crash, a=testonly https://hg.mozilla.org/integration/autoland/rev/cdac7b17cbf7 [wpt PR 50148] - Update wpt metadata, a=testonly

https://hg.mozilla.org/mozilla-central/rev/00690abc4037
https://hg.mozilla.org/mozilla-central/rev/cdac7b17cbf7

Status: NEW → RESOLVED
Closed: 26 days ago
status-firefox136: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 136 Branch
You need to log in before you can comment on or make changes to this bug.