Check documentElement conditions in parser* DOM mutation methods

Source/core/editing/markup.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009, 2010, 2011 Google Inc. All rights reserved.
  * Copyright (C) 2011 Igalia S.L.
  * Copyright (C) 2011 Motorola Mobility. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
@@ skipping 269 matching lines @@
     fragment->parseHTML(markup, fakeBody.get(), parserContentPolicy);
 
     if (!baseURL.isEmpty() && baseURL != blankURL() && baseURL != document.baseURL())
         completeURLs(*fragment, baseURL);
 
     return fragment.release();
 }
 
 static const char fragmentMarkerTag[] = "webkit-fragment-marker";
 
-static bool findNodesSurroundingContext(Document* document, RefPtrWillBeRawPtr<Comment>& nodeBeforeContext, RefPtrWillBeRawPtr<Comment>& nodeAfterContext)
+static bool findNodesSurroundingContext(DocumentFragment* fragment, RefPtrWillBeRawPtr<Comment>& nodeBeforeContext, RefPtrWillBeRawPtr<Comment>& nodeAfterContext)
 {
-    for (Node& node : NodeTraversal::startsAt(document->firstChild())) {
+    for (Node& node : NodeTraversal::startsAt(fragment->firstChild())) {
         if (node.nodeType() == Node::COMMENT_NODE && toComment(node).data() == fragmentMarkerTag) {
             if (!nodeBeforeContext)
                 nodeBeforeContext = &toComment(node);
             else {
                 nodeAfterContext = &toComment(node);
                 return true;
             }
         }
     }
     return false;
@@ skipping 27 matching lines @@
     // FIXME: Need to handle the case where the markup already contains these markers.
 
     StringBuilder taggedMarkup;
     taggedMarkup.append(markup.left(fragmentStart));
     MarkupAccumulator::appendComment(taggedMarkup, fragmentMarkerTag);
     taggedMarkup.append(markup.substring(fragmentStart, fragmentEnd - fragmentStart));
     MarkupAccumulator::appendComment(taggedMarkup, fragmentMarkerTag);
     taggedMarkup.append(markup.substring(fragmentEnd));
 
     RefPtrWillBeRawPtr<DocumentFragment> taggedFragment = createFragmentFromMarkup(document, taggedMarkup.toString(), baseURL, parserContentPolicy);
+
+    RefPtrWillBeRawPtr<Comment> nodeBeforeContext = nullptr;
+    RefPtrWillBeRawPtr<Comment> nodeAfterContext = nullptr;
+    if (!findNodesSurroundingContext(taggedFragment.get(), nodeBeforeContext, nodeAfterContext))
+        return nullptr;
+
     RefPtrWillBeRawPtr<Document> taggedDocument = Document::create();
     taggedDocument->setContextFeatures(document.contextFeatures());
 
-    // FIXME: It's not clear what this code is trying to do. It puts nodes as direct children of a
-    // Document that are not normally allowed by using the parser machinery.
-    taggedDocument->parserTakeAllChildrenFrom(*taggedFragment);
-
-    RefPtrWillBeRawPtr<Comment> nodeBeforeContext = nullptr;
-    RefPtrWillBeRawPtr<Comment> nodeAfterContext = nullptr;
-    if (!findNodesSurroundingContext(taggedDocument.get(), nodeBeforeContext, nodeAfterContext))
-        return nullptr;
+    RefPtrWillBeRawPtr<Element> root = Element::create(QualifiedName::null(), taggedDocument.get());
+    root->appendChild(taggedFragment.get());
+    taggedDocument->appendChild(root);
 
     RefPtrWillBeRawPtr<Range> range = Range::create(*taggedDocument.get(),
         positionAfterNode(nodeBeforeContext.get()).parentAnchoredEquivalent(),
         positionBeforeNode(nodeAfterContext.get()).parentAnchoredEquivalent());
 
     Node* commonAncestor = range->commonAncestorContainer();
     HTMLElement* specialCommonAncestor = ancestorToRetainStructureAndAppearanceWithNoLayoutObject(commonAncestor);
 
     // When there's a special common ancestor outside of the fragment, we must include it as well to
     // preserve the structure and appearance of the fragment. For example, if the fragment contains
@@ skipping 334 matching lines @@
 
     RefPtrWillBeRawPtr<Text> textNext = toText(next);
     textNode->appendData(textNext->data());
     if (textNext->parentNode()) // Might have been removed by mutation event.
         textNext->remove(exceptionState);
 }
 
 template class CORE_TEMPLATE_EXPORT CreateMarkupAlgorithm<EditingStrategy>;
 
 }