New issue
Advanced search Search tips

Issue 711568 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: May 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug

Blocked on:
issue 722741

Blocking:
issue 651744



Sign in to add a comment

Reversed MutationRecords for inserting <script> which inserts another element

Project Member Reported by tkent@chromium.org, Apr 14 2017

Issue description

Chrome Version: 59 canary
OS: All but iOS

What steps will reproduce the problem?
(1) Open http://w3c-test.org/dom/nodes/MutationObserver-document.html

What is the expected result?
No FAIL tess

What happens instead?
One FAIL test.

Please use labels and text to provide additional information.

DOM mutations in the failing test is:

<p id='n00'></p><script id='s002'>
  var newScript = document.createElement("script");
  setupTest.step(function() {
    newScript.textContent = "document.body.appendChild(newElement);";
    newScript.id = "inserted_script";
    document.getElementById("n00").appendChild(newScript);

Expected MutationRecords are:

                       [{type: "childList",
                         addedNodes: function () {
                           return [ document.getElementById("inserted_script") ];
                         },
                         target: function () {
                          return document.getElementById("n00");
                         }},
                        {type: "childList",
                         addedNodes: function () {
                           return [ document.getElementById("inserted_element") ];
                         },
                         previousSibling: function () {
                           return document.getElementById("s002");
                         },
                         target: document.body}
                        ]

However, the order of MutaionRecords are reversed in Chromium browser.

 

Comment 1 by tkent@chromium.org, May 16 2017

Blockedon: 722741

Comment 2 by tkent@chromium.org, May 22 2017

Owner: tkent@chromium.org
Status: Started (was: Available)
Project Member

Comment 3 by bugdroid1@chromium.org, May 22 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5a3def7f350a35e7e481714f0d3851c9434cdeec

commit 5a3def7f350a35e7e481714f0d3851c9434cdeec
Author: tkent <tkent@chromium.org>
Date: Mon May 22 06:02:24 2017

DOM: Fix an issue of reversed MutationRecoards.

In appendChild, insertBefore, and replaceChild, ChildListMutationScope should be
destructed before calling notifications which can execute author scripts.

This CL splits InsertNodeVector() into two parts; one should be wrapped with
ChildListMutationScope, and another should not.

The new behavior matches to the DOM standard, Firefox, and Edge.

BUG= 711568 

Review-Url: https://codereview.chromium.org/2899613002
Cr-Commit-Position: refs/heads/master@{#473512}

[delete] https://crrev.com/6f832b7a5ad0f23098edfc38d4a2c60c2b66b3ff/third_party/WebKit/LayoutTests/external/wpt/dom/nodes/MutationObserver-document-expected.txt
[modify] https://crrev.com/5a3def7f350a35e7e481714f0d3851c9434cdeec/third_party/WebKit/Source/core/dom/ContainerNode.cpp
[modify] https://crrev.com/5a3def7f350a35e7e481714f0d3851c9434cdeec/third_party/WebKit/Source/core/dom/ContainerNode.h

Comment 4 by tkent@chromium.org, May 22 2017

Labels: M-60
Status: Fixed (was: Started)

Sign in to add a comment