Fix Range.createContextualFragment for non-Element contexts.

Source/core/dom/Range.cpp

 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Motorola Mobility. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Library General Public License for more details.
  *
  * You should have received a copy of the GNU Library General Public License
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
 
 #include "config.h"
 #include "core/dom/Range.h"
 
+#include "HTMLNames.h"
 #include "bindings/v8/ExceptionState.h"
 #include "core/dom/ClientRect.h"
 #include "core/dom/ClientRectList.h"
 #include "core/dom/DocumentFragment.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/Node.h"
 #include "core/dom/NodeTraversal.h"
 #include "core/dom/NodeWithIndex.h"
 #include "core/dom/ProcessingInstruction.h"
-#include "core/events/ScopedEventQueue.h"
 #include "core/dom/Text.h"
 #include "core/editing/TextIterator.h"
 #include "core/editing/VisiblePosition.h"
 #include "core/editing/VisibleUnits.h"
 #include "core/editing/markup.h"
+#include "core/events/ScopedEventQueue.h"
+#include "core/html/HTMLBodyElement.h"
 #include "core/html/HTMLElement.h"
 #include "core/rendering/RenderBoxModelObject.h"
 #include "core/rendering/RenderText.h"
+#include "core/svg/SVGDocument.h"
+#include "core/svg/SVGElement.h"
+#include "core/svg/SVGSVGElement.h"
 #include "platform/geometry/FloatQuad.h"
 #include "wtf/RefCountedLeakCounter.h"
 #include "wtf/text/CString.h"
 #include "wtf/text/StringBuilder.h"
 #ifndef NDEBUG
 #include <stdio.h>
 #endif
 
 namespace WebCore {
 
@@ skipping 1040 matching lines @@
 
     // We need to update layout, since plainText uses line boxes in the render tree.
     // FIXME: As with innerText, we'd like this to work even if there are no render objects.
     m_start.container()->document().updateLayout();
 
     return plainText(this);
 }
 
 PassRefPtr<DocumentFragment> Range::createContextualFragment(const String& markup, ExceptionState& exceptionState)
 {
-    if (!m_start.container()) {
+    // Algorithm: http://domparsing.spec.whatwg.org/#extensions-to-the-range-interface
+
+    Node* startContainer = m_start.container();
+    if (!startContainer) {
         exceptionState.throwDOMException(InvalidStateError, "The range has no container. Perhaps 'detatch()' has been invoked on this object?");
         return 0;
     }
 
-    Node* element = m_start.container()->isElementNode() ? m_start.container() : m_start.container()->parentNode();
-    if (!element || !element->isHTMLElement()) {
-        exceptionState.throwDOMException(NotSupportedError, "The range's container must be an HTML element.");
-        return 0;
+    // Step 1.
+    Node* element;
+    if (!m_start.offset() && (m_start.container()->isDocumentNode() || m_start.container()->isDocumentFragment())) {
+        element = 0;
+    } else if (startContainer->isElementNode()) {
+        element = startContainer;
+    } else {
+        element = startContainer->parentNode();
+        if (!element || !element->isElementNode()) {
+            exceptionState.throwDOMException(NotSupportedError, "The range's container must be an Element, Document, or DocumentFragment.");
+            return 0;
+        }
     }
+    ASSERT(!element || element->isElementNode());
 
-    RefPtr<DocumentFragment> fragment = WebCore::createContextualFragment(markup, toHTMLElement(element), AllowScriptingContentAndDoNotMarkAlreadyStarted, exceptionState);
+    // Step 2.
+    RefPtr<Element> fakeBody = 0;
+    if (!element || (element->isHTMLElement() && toHTMLElement(element)->hasLocalName(HTMLNames::htmlTag))) {
+        Document& document = startContainer->document();
+        // Try to use the existing <body> element, if it is available.
+        if (document.isHTMLDocument() || document.isXHTMLDocument())
+            element = document.body();
+        else if (document.isSVGDocument())
+            element = toSVGDocument(document).rootElement();
+
+        if (!element) {
+            // SVG documents always have an <svg> root element, should never need a fake node.
+            ASSERT(document.isHTMLDocument() || document.isXHTMLDocument());
+            fakeBody = HTMLBodyElement::create(document);
+            element = fakeBody.get();
+        }
+    } else {
+        if (!element->isHTMLElement() && !element->isSVGElement()) {
+            exceptionState.throwDOMException(NotSupportedError, "The range's container must be an Element, Document, or DocumentFragment.");
+            return 0;
+        }
+    }
+    ASSERT(element && (element->isHTMLElement() || element->isSVGElement()));

[yosin_UTC9, 2014/05/29 03:53:06]

Is this ASSERT always true?
We can set any node to document.documentElement, e.g.
document.replaceChild(someNode, document.documentElement);

[pwnall-personal, 2014/06/02 06:57:57]

The patch uses document.body() for HTML/XHTML documents. I think that returns
null in the case that you mentioned. Also, I think it's an interesting edge
case, so I added a test to make sure it stays covered.

+
+    // Steps 3, 4, 5.
+    RefPtr<DocumentFragment> fragment;
+    if (element->isHTMLElement())
+        fragment = WebCore::createContextualFragment(markup, toHTMLElement(element), AllowScriptingContentAndDoNotMarkAlreadyStarted, exceptionState);
+    else
+        fragment = WebCore::createContextualFragment(markup, toSVGElement(element), AllowScriptingContentAndDoNotMarkAlreadyStarted, exceptionState);
+
     if (!fragment)
         return 0;
 
     return fragment.release();
 }
 
 
 void Range::detach(ExceptionState& exceptionState)
 {
     // Check first to see if we've already detached:
@@ skipping 787 matching lines @@
 
 void showTree(const WebCore::Range* range)
 {
     if (range && range->boundaryPointsValid()) {
         range->startContainer()->showTreeAndMark(range->startContainer(), "S", range->endContainer(), "E");
         fprintf(stderr, "start offset: %d, end offset: %d\n", range->startOffset(), range->endOffset());
     }
 }
 
 #endif