XML error document creation should not fire mutation events

https://bugs.webkit.org/show_bug.cgi?id=80765

Reviewed by Adam Barth.

Source/WebCore:

Broke two tests that expected the old behavior, which have now been updated.

* xml/XMLErrors.cpp:
(WebCore::createXHTMLParserErrorHeader):
(WebCore::XMLErrors::insertErrorMessageBlock):

LayoutTests:

Fixed tests that relied on old behavior.

* fast/css/stylesheet-candidate-nodes-crash-expected.txt:
* fast/css/stylesheet-candidate-nodes-crash.xhtml:
* fast/dom/xml-parser-error-message-crash-expected.txt:


git-svn-id: svn://svn.chromium.org/blink/trunk@112023 bbb929c8-8fbe-4397-9dbb-9b2b20218538

6 files changed, 99 insertions, 43 deletions

diff --git a/third_party/WebKit/LayoutTests/ChangeLog b/third_party/WebKit/LayoutTests/ChangeLog
index d529192..4775bd4 100644
--- a/third_party/WebKit/LayoutTests/ChangeLog
+++ b/third_party/WebKit/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2012-03-24  Jeffrey Pfau  <jpfau@apple.com>
+
+        XML error document creation should not fire mutation events
+        https://bugs.webkit.org/show_bug.cgi?id=80765
+
+        Reviewed by Adam Barth.
+
+        Fixed tests that relied on old behavior.
+
+        * fast/css/stylesheet-candidate-nodes-crash-expected.txt:
+        * fast/css/stylesheet-candidate-nodes-crash.xhtml:
+        * fast/dom/xml-parser-error-message-crash-expected.txt:
+
 2012-03-24  Florin Malita  <fmalita@google.com>
 
         ForeignObject content is zoomed two times
diff --git a/third_party/WebKit/LayoutTests/fast/css/stylesheet-candidate-nodes-crash-expected.txt b/third_party/WebKit/LayoutTests/fast/css/stylesheet-candidate-nodes-crash-expected.txt
index 4346ce6..7ef22e9 100644
--- a/third_party/WebKit/LayoutTests/fast/css/stylesheet-candidate-nodes-crash-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/css/stylesheet-candidate-nodes-crash-expected.txt
@@ -1,7 +1 @@
-This page contains the following errors:
-
-error on line 29 at column 9: Comment not terminated 
-error on line 32 at column 1: Comment not terminated
-Below is a rendering of the page up to the first error.
-
 PASS
diff --git a/third_party/WebKit/LayoutTests/fast/css/stylesheet-candidate-nodes-crash.xhtml b/third_party/WebKit/LayoutTests/fast/css/stylesheet-candidate-nodes-crash.xhtml
index d0ecff4..6d20e91 100644
--- a/third_party/WebKit/LayoutTests/fast/css/stylesheet-candidate-nodes-crash.xhtml
+++ b/third_party/WebKit/LayoutTests/fast/css/stylesheet-candidate-nodes-crash.xhtml
@@ -7,20 +7,20 @@
                     layoutTestController.dumpAsText();

                     layoutTestController.waitUntilDone();

                 }

-                

+

                 function runTest()

                 {

                     document.getElementsByTagNameNS('http://www.w3.org/1999/xhtml', 'style')[0];

-                    if (document.body)

+                    if (document.body) {

                         document.body.innerHTML = "PASS";

-                    

-                    if (window.layoutTestController)

-                        layoutTestController.notifyDone();

+                        if (window.layoutTestController)

+                            layoutTestController.notifyDone();

+                    }

                 }

             </script>

             <svg:style>

                 <xht:caption>

-                    <xht:iframe onload="runTest();"></xht:iframe>             

+                    <xht:iframe onload="runTest();"></xht:iframe>

                     <style></style>

                 </xht:caption>

             </svg:style>

diff --git a/third_party/WebKit/LayoutTests/fast/dom/xml-parser-error-message-crash-expected.txt b/third_party/WebKit/LayoutTests/fast/dom/xml-parser-error-message-crash-expected.txt
index 7ef22e9..fedbc414 100644
--- a/third_party/WebKit/LayoutTests/fast/dom/xml-parser-error-message-crash-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/dom/xml-parser-error-message-crash-expected.txt
@@ -1 +1,6 @@
-PASS
+This page contains the following errors:
+
+error on line 14 at column 1: Extra content at the end of the document
+Below is a rendering of the page up to the first error.
+
+
diff --git a/third_party/WebKit/Source/WebCore/ChangeLog b/third_party/WebKit/Source/WebCore/ChangeLog
index e45ca5c..d4a5710 100644
--- a/third_party/WebKit/Source/WebCore/ChangeLog
+++ b/third_party/WebKit/Source/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2012-03-24  Jeffrey Pfau  <jpfau@apple.com>
+
+        XML error document creation should not fire mutation events
+        https://bugs.webkit.org/show_bug.cgi?id=80765
+
+        Reviewed by Adam Barth.
+
+        Broke two tests that expected the old behavior, which have now been updated.
+
+        * xml/XMLErrors.cpp:
+        (WebCore::createXHTMLParserErrorHeader):
+        (WebCore::XMLErrors::insertErrorMessageBlock):
+
 2012-03-24  Florin Malita  <fmalita@google.com>
 
         ForeignObject content is zoomed two times
diff --git a/third_party/WebKit/Source/WebCore/xml/XMLErrors.cpp b/third_party/WebKit/Source/WebCore/xml/XMLErrors.cpp
index 87fcf27..3d4113d 100644
--- a/third_party/WebKit/Source/WebCore/xml/XMLErrors.cpp
+++ b/third_party/WebKit/Source/WebCore/xml/XMLErrors.cpp
@@ -87,26 +87,31 @@ void XMLErrors::appendErrorMessage(const String& typeString, TextPosition positi
     m_errorMessages.append(message);
 }
 
-static inline RefPtr<Element> createXHTMLParserErrorHeader(Document* doc, const String& errorMessages)
+static inline PassRefPtr<Element> createXHTMLParserErrorHeader(Document* doc, const String& errorMessages)
 {
-    RefPtr<Element> reportElement = doc->createElement(QualifiedName(nullAtom, "parsererror", xhtmlNamespaceURI), false);
-    reportElement->setAttribute(styleAttr, "display: block; white-space: pre; border: 2px solid #c77; padding: 0 1em 0 1em; margin: 1em; background-color: #fdd; color: black");
+    RefPtr<Element> reportElement = doc->createElement(QualifiedName(nullAtom, "parsererror", xhtmlNamespaceURI), true);
 
-    ExceptionCode ec = 0;
-    RefPtr<Element> h3 = doc->createElement(h3Tag, false);
-    reportElement->appendChild(h3.get(), ec);
-    h3->appendChild(doc->createTextNode("This page contains the following errors:"), ec);
+    OwnPtr<AttributeVector> reportAttributes = AttributeVector::create();
+    reportAttributes->append(Attribute::create(styleAttr, "display: block; white-space: pre; border: 2px solid #c77; padding: 0 1em 0 1em; margin: 1em; background-color: #fdd; color: black"));
+    reportElement->parserSetAttributes(reportAttributes.release(), FragmentScriptingNotAllowed);
 
-    RefPtr<Element> fixed = doc->createElement(divTag, false);
-    reportElement->appendChild(fixed.get(), ec);
-    fixed->setAttribute(styleAttr, "font-family:monospace;font-size:12px");
-    fixed->appendChild(doc->createTextNode(errorMessages), ec);
+    RefPtr<Element> h3 = doc->createElement(h3Tag, true);
+    reportElement->parserAddChild(h3.get());
+    h3->parserAddChild(doc->createTextNode("This page contains the following errors:"));
 
-    h3 = doc->createElement(h3Tag, false);
-    reportElement->appendChild(h3.get(), ec);
-    h3->appendChild(doc->createTextNode("Below is a rendering of the page up to the first error."), ec);
+    RefPtr<Element> fixed = doc->createElement(divTag, true);
+    OwnPtr<AttributeVector> fixedAttributes = AttributeVector::create();
+    fixedAttributes->append(Attribute::create(styleAttr, "font-family:monospace;font-size:12px"));
+    fixed->parserSetAttributes(fixedAttributes.release(), FragmentScriptingNotAllowed);
+    reportElement->parserAddChild(fixed.get());
 
-    return reportElement;
+    fixed->parserAddChild(doc->createTextNode(errorMessages));
+
+    h3 = doc->createElement(h3Tag, true);
+    reportElement->parserAddChild(h3.get());
+    h3->parserAddChild(doc->createTextNode("Below is a rendering of the page up to the first error."));
+
+    return reportElement.release();
 }
 
 void XMLErrors::insertErrorMessageBlock()
@@ -116,36 +121,62 @@ void XMLErrors::insertErrorMessageBlock()
     // where the errors are located)
 
     // Create elements for display
-    ExceptionCode ec = 0;
     RefPtr<Element> documentElement = m_document->documentElement();
     if (!documentElement) {
-        RefPtr<Element> rootElement = m_document->createElement(htmlTag, false);
-        m_document->appendChild(rootElement, ec);
-        RefPtr<Element> body = m_document->createElement(bodyTag, false);
-        rootElement->appendChild(body, ec);
+        RefPtr<Element> rootElement = m_document->createElement(htmlTag, true);
+        RefPtr<Element> body = m_document->createElement(bodyTag, true);
+        rootElement->parserAddChild(body);
+        m_document->parserAddChild(rootElement);
+        if (m_document->attached() && !rootElement->attached())
+            rootElement->attach();
         documentElement = body.get();
     }
 #if ENABLE(SVG)
     else if (documentElement->namespaceURI() == SVGNames::svgNamespaceURI) {
-        RefPtr<Element> rootElement = m_document->createElement(htmlTag, false);
-        RefPtr<Element> body = m_document->createElement(bodyTag, false);
-        rootElement->appendChild(body, ec);
-        body->appendChild(documentElement, ec);
-        m_document->appendChild(rootElement.get(), ec);
+        RefPtr<Element> rootElement = m_document->createElement(htmlTag, true);
+        RefPtr<Element> body = m_document->createElement(bodyTag, true);
+        rootElement->parserAddChild(body);
+
+        documentElement->parentNode()->parserRemoveChild(documentElement.get());
+        if (documentElement->attached())
+            documentElement->detach();
+
+        body->parserAddChild(documentElement);
+        m_document->parserAddChild(rootElement.get());
+
+        if (m_document->attached()) {
+            // rootElement shouldn't be attached right now, but in some cases might be.
+            // See https://bugs.webkit.org/show_bug.cgi?id=81985
+            rootElement->reattach();
+        }
+
         documentElement = body.get();
     }
 #endif
+
     String errorMessages = m_errorMessages.toString();
     RefPtr<Element> reportElement = createXHTMLParserErrorHeader(m_document, errorMessages);
-    documentElement->insertBefore(reportElement, documentElement->firstChild(), ec);
+
 #if ENABLE(XSLT)
     if (m_document->transformSourceDocument()) {
-        RefPtr<Element> paragraph = m_document->createElement(pTag, false);
-        paragraph->setAttribute(styleAttr, "white-space: normal");
-        paragraph->appendChild(m_document->createTextNode("This document was created as the result of an XSL transformation. The line and column numbers given are from the transformed result."), ec);
-        reportElement->appendChild(paragraph.release(), ec);
+        OwnPtr<AttributeVector> attributes = AttributeVector::create();
+        attributes->append(Attribute::create(styleAttr, "white-space: normal"));
+        RefPtr<Element> paragraph = m_document->createElement(pTag, true);
+        paragraph->parserSetAttributes(attributes.release(), FragmentScriptingNotAllowed);
+        paragraph->parserAddChild(m_document->createTextNode("This document was created as the result of an XSL transformation. The line and column numbers given are from the transformed result."));
+        reportElement->parserAddChild(paragraph.release());
     }
 #endif
+
+    Node* firstChild = documentElement->firstChild();
+    if (firstChild)
+        documentElement->parserInsertBefore(reportElement, documentElement->firstChild());
+    else
+        documentElement->parserAddChild(reportElement);
+
+    if (documentElement->attached() && !reportElement->attached())
+        reportElement->attach();
+
     m_document->updateStyleIfNeeded();
 }