Skip to content
Permalink
Browse files
If an <object> is removed from the page while its fallback content is…
… being used, Safari will automatically use fallback content when the object is re-inserted.

https://bugs.webkit.org/show_bug.cgi?id=44827

Reviewed by Alexey Proskuryakov.

The bug was caused by HTMLObjectElement::parseAttribute not resetting m_useFallbackContent
when the object element is disconnected. This patch addresses it and adds a test.

* Source/WebCore/html/HTMLObjectElement.cpp:
(WebCore::HTMLObjectElement::parseAttribute):

* LayoutTests/fast/dom/HTMLObjectElement/object-element-fallback-content-update-expected.txt: Added.
* LayoutTests/fast/dom/HTMLObjectElement/object-element-fallback-content-update.html: Added.

Canonical link: https://commits.webkit.org/251903@main
  • Loading branch information
rniwa committed Jun 28, 2022
1 parent a3dd7dc commit fdae8b382e051d3ca6521d2c5a90bc3169ffe098
Show file tree
Hide file tree
Showing 3 changed files with 44 additions and 4 deletions.
@@ -0,0 +1,10 @@
This tests updating an object element which was showing fallback content while it's disconnected from the document.
WebKit should update the object element when it gets reinserted back into the document.
Test passes if you see "PASS" below:



--------
Frame: '<!--frame1-->'
--------
PASS
@@ -0,0 +1,25 @@
<!DOCTYPE html>
<html>
<body>
<p>This tests updating an object element which was showing fallback content while it's disconnected from the document.<br>
WebKit should update the object element when it gets reinserted back into the document.<br>
Test passes if you see "PASS" below:</p>
<object width="100" height="100">FAIL</object>
<script>

if (window.testRunner) {
testRunner.dumpAsText();
testRunner.dumpChildFramesAsText();
}

onload = () => {
let object = document.querySelector('object');
object.remove();
object.setAttribute('type', 'text/html');
object.setAttribute('data', 'data:text/html,PASS');
document.body.appendChild(object);
}

</script>
</body>
</html>
@@ -102,28 +102,33 @@ void HTMLObjectElement::collectPresentationalHintsForAttribute(const QualifiedNa
void HTMLObjectElement::parseAttribute(const QualifiedName& name, const AtomString& value)
{
bool invalidateRenderer = false;
bool needsWidgetUpdate = false;

if (name == formAttr)
formAttributeChanged();
else if (name == typeAttr) {
m_serviceType = value.string().left(value.find(';')).convertToASCIILowercase();
invalidateRenderer = !hasAttributeWithoutSynchronization(classidAttr);
setNeedsWidgetUpdate(true);
needsWidgetUpdate = true;
} else if (name == dataAttr) {
m_url = stripLeadingAndTrailingHTMLSpaces(value);
invalidateRenderer = !hasAttributeWithoutSynchronization(classidAttr);
setNeedsWidgetUpdate(true);
needsWidgetUpdate = true;
updateImageLoaderWithNewURLSoon();
} else if (name == classidAttr) {
invalidateRenderer = true;
setNeedsWidgetUpdate(true);
needsWidgetUpdate = true;
} else
HTMLPlugInImageElement::parseAttribute(name, value);

if (needsWidgetUpdate) {
setNeedsWidgetUpdate(true);
m_useFallbackContent = false;
}

if (!invalidateRenderer || !isConnected() || !renderer())
return;

m_useFallbackContent = false;
scheduleUpdateForAfterStyleResolution();
invalidateStyleAndRenderersForSubtree();
}

0 comments on commit fdae8b3

Please sign in to comment.