Make sure the rootNode of a LiveNodeListBase is always a ContainerNode

Source/core/html/HTMLCollection.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2011, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 142 matching lines @@
     case HTMLTagNodeListType:
     case RadioNodeListType:
     case RadioImgNodeListType:
     case LabelsNodeListType:
         break;
     }
     ASSERT_NOT_REACHED();
     return DoNotInvalidateOnAttributeChanges;
 }
 
-HTMLCollection::HTMLCollection(Node* ownerNode, CollectionType type, ItemAfterOverrideType itemAfterOverrideType)
+HTMLCollection::HTMLCollection(ContainerNode* ownerNode, CollectionType type, ItemAfterOverrideType itemAfterOverrideType)
     : LiveNodeListBase(ownerNode, rootTypeFromCollectionType(type), invalidationTypeExcludingIdAndNameAttributes(type),
         WebCore::shouldOnlyIncludeDirectChildren(type), type, itemAfterOverrideType)
     , m_isNameCacheValid(false)
 {
     ScriptWrappable::init(this);
 }
 
-PassRefPtr<HTMLCollection> HTMLCollection::create(Node* base, CollectionType type)
+PassRefPtr<HTMLCollection> HTMLCollection::create(ContainerNode* base, CollectionType type)
 {
     return adoptRef(new HTMLCollection(base, type, DoesNotOverrideItemAfter));
 }
 
 HTMLCollection::~HTMLCollection()
 {
     // HTMLNameCollection removes cache by itself.
     if (type() != WindowNamedItems && type() != DocumentNamedItems)
         ownerNode()->nodeLists()->removeCacheWithAtomicName(this, type());
 }
@@ skipping 133 matching lines @@
 template <class NodeListType>
 inline Element* firstMatchingElement(const NodeListType* nodeList, ContainerNode& root)
 {
     Element* element = ElementTraversal::firstWithin(root);
     while (element && !isMatchingElement(nodeList, element))
         element = ElementTraversal::next(*element, &root);
     return element;
 }
 
 template <class NodeListType>
-inline Element* nextMatchingElement(const NodeListType* nodeList, Element& current, ContainerNode* root)
+inline Element* nextMatchingElement(const NodeListType* nodeList, Element& current, ContainerNode& root)
 {
     Element* next = &current;
     do {
-        next = ElementTraversal::next(*next, root);
+        next = ElementTraversal::next(*next, &root);
     } while (next && !isMatchingElement(nodeList, next));
     return next;
 }
 
 template <class NodeListType>
-inline Element* traverseMatchingElementsForwardToOffset(const NodeListType* nodeList, unsigned offset, Element& currentElement, unsigned& currentOffset, ContainerNode* root)
+inline Element* traverseMatchingElementsForwardToOffset(const NodeListType* nodeList, unsigned offset, Element& currentElement, unsigned& currentOffset, ContainerNode& root)
 {
     ASSERT(currentOffset < offset);
     Element* next = &currentElement;
     while ((next = nextMatchingElement(nodeList, *next, root))) {
         if (++currentOffset == offset)
             return next;
     }
     return 0;
 }
 
@@ skipping 20 matching lines @@
         return firstMatchingElement(static_cast<const HTMLTagNodeList*>(this), root);
     case ClassNodeListType:
         return firstMatchingElement(static_cast<const ClassNodeList*>(this), root);
     default:
         return firstMatchingElement(static_cast<const LiveNodeList*>(this), root);
     }
 }
 
 // FIXME: This should be in LiveNodeList.cpp but it needs to stay here until traverseMatchingElementsForwardToOffset()
 // and others are moved to a separate header.
-inline Node* LiveNodeList::traverseForwardToOffset(unsigned offset, Node& currentNode, unsigned& currentOffset, ContainerNode* root) const
+inline Node* LiveNodeList::traverseForwardToOffset(unsigned offset, Node& currentNode, unsigned& currentOffset, ContainerNode& root) const
 {
     switch (type()) {
     case ChildNodeListType:
         return traverseSiblingsForwardToOffset(offset, currentNode, currentOffset);
     case HTMLTagNodeListType:
         return traverseMatchingElementsForwardToOffset(static_cast<const HTMLTagNodeList*>(this), offset, toElement(currentNode), currentOffset, root);
     case ClassNodeListType:
         return traverseMatchingElementsForwardToOffset(static_cast<const ClassNodeList*>(this), offset, toElement(currentNode), currentOffset, root);
     default:
         return traverseMatchingElementsForwardToOffset(this, offset, toElement(currentNode), currentOffset, root);
@@ skipping 33 matching lines @@
 
 // FIXME: It is silly that these functions are in HTMLCollection.cpp.
 Node* LiveNodeListBase::item(unsigned offset) const
 {
     if (isItemCacheValid() && cachedItemOffset() == offset)
         return cachedItem();
 
     if (isLengthCacheValid() && cachedLength() <= offset)
         return 0;
 
-    ContainerNode* root = rootContainerNode();
-    if (!root) {
-        // FIMXE: In someTextNode.childNodes case the root is Text. We shouldn't even make a LiveNodeList for that.
-        setLengthCache(0);
-        return 0;
-    }
-
+    ContainerNode& root = rootNode();
     if (isLengthCacheValid() && !overridesItemAfter() && isLastItemCloserThanLastOrCachedItem(offset)) {
         Node* lastItem = itemBefore(0);
         ASSERT(lastItem);
         setItemCache(lastItem, cachedLength() - 1);
     } else if (!isItemCacheValid() || isFirstItemCloserThanCachedItem(offset) || (overridesItemAfter() && offset < cachedItemOffset())) {
         Node* firstItem;
         if (isLiveNodeListType(type()))
-            firstItem = static_cast<const LiveNodeList*>(this)->traverseToFirstElement(*root);
+            firstItem = static_cast<const LiveNodeList*>(this)->traverseToFirstElement(root);
         else
-            firstItem = static_cast<const HTMLCollection*>(this)->traverseToFirstElement(*root);
+            firstItem = static_cast<const HTMLCollection*>(this)->traverseToFirstElement(root);
 
         if (!firstItem) {
             setLengthCache(0);
             return 0;
         }
         setItemCache(firstItem, 0);
         ASSERT(!cachedItemOffset());
     }
 
     if (cachedItemOffset() == offset)
         return cachedItem();
 
     return itemBeforeOrAfterCachedItem(offset, root);
 }
 
-inline Node* LiveNodeListBase::itemBeforeOrAfterCachedItem(unsigned offset, ContainerNode* root) const
+inline Node* LiveNodeListBase::itemBeforeOrAfterCachedItem(unsigned offset, ContainerNode& root) const
 {
     unsigned currentOffset = cachedItemOffset();
     Node* currentItem = cachedItem();
     ASSERT(currentItem);
     ASSERT(currentOffset != offset);
 
     if (offset < cachedItemOffset()) {
         ASSERT(!overridesItemAfter());
         while ((currentItem = itemBefore(currentItem))) {
             ASSERT(currentOffset);
@@ skipping 56 matching lines @@
 }
 
 inline Element* firstMatchingChildElement(const HTMLCollection* nodeList, ContainerNode& root)
 {
     Element* element = ElementTraversal::firstWithin(root);
     while (element && !isMatchingElement(nodeList, element))
         element = ElementTraversal::nextSkippingChildren(*element, &root);
     return element;
 }
 
-inline Element* nextMatchingChildElement(const HTMLCollection* nodeList, Element& current, ContainerNode* root)
+inline Element* nextMatchingChildElement(const HTMLCollection* nodeList, Element& current, ContainerNode& root)
 {
     Element* next = &current;
     do {
-        next = ElementTraversal::nextSkippingChildren(*next, root);
+        next = ElementTraversal::nextSkippingChildren(*next, &root);
     } while (next && !isMatchingElement(nodeList, next));
     return next;
 }
 
 inline Element* HTMLCollection::traverseToFirstElement(ContainerNode& root) const
 {
     if (overridesItemAfter())
         return virtualItemAfter(0);
     if (shouldOnlyIncludeDirectChildren())
         return firstMatchingChildElement(static_cast<const HTMLCollection*>(this), root);
     return firstMatchingElement(static_cast<const HTMLCollection*>(this), root);
 }
 
-inline Element* HTMLCollection::traverseNextElement(Element& previous, ContainerNode* root) const
+inline Element* HTMLCollection::traverseNextElement(Element& previous, ContainerNode& root) const
 {
     if (overridesItemAfter())
         return virtualItemAfter(&previous);
     if (shouldOnlyIncludeDirectChildren())
         return nextMatchingChildElement(this, previous, root);
     return nextMatchingElement(this, previous, root);
 }
 
-inline Element* HTMLCollection::traverseForwardToOffset(unsigned offset, Element& currentElement, unsigned& currentOffset, ContainerNode* root) const
+inline Element* HTMLCollection::traverseForwardToOffset(unsigned offset, Element& currentElement, unsigned& currentOffset, ContainerNode& root) const
 {
     ASSERT(currentOffset < offset);
     if (overridesItemAfter()) {
         Element* next = &currentElement;
         while ((next = virtualItemAfter(next))) {
             if (++currentOffset == offset)
                 return next;
         }
         return 0;
     }
     if (shouldOnlyIncludeDirectChildren()) {
         Element* next = &currentElement;
         while ((next = nextMatchingChildElement(this, *next, root))) {
             if (++currentOffset == offset)
                 return next;
         }
         return 0;
     }
     return traverseMatchingElementsForwardToOffset(this, offset, currentElement, currentOffset, root);
 }
 
 Node* HTMLCollection::namedItem(const AtomicString& name) const
 {
     // http://msdn.microsoft.com/workshop/author/dhtml/reference/methods/nameditem.asp
     // This method first searches for an object with a matching id
     // attribute. If a match is not found, the method then searches for an
     // object with a matching name attribute, but only on those elements
     // that are allowed a name attribute.
 
-    ContainerNode* root = rootContainerNode();
-    if (!root)
-        return 0;
-
+    ContainerNode& root = rootNode();
     unsigned i = 0;
-    for (Element* element = traverseToFirstElement(*root); element; element = traverseNextElement(*element, root)) {
+    for (Element* element = traverseToFirstElement(root); element; element = traverseNextElement(*element, root)) {
         if (checkForNameMatch(element, /* checkName */ false, name)) {
             setItemCache(element, i);
             return element;
         }
         i++;
     }
 
     i = 0;
-    for (Element* element = traverseToFirstElement(*root); element; element = traverseNextElement(*element, root)) {
+    for (Element* element = traverseToFirstElement(root); element; element = traverseNextElement(*element, root)) {
         if (checkForNameMatch(element, /* checkName */ true, name)) {
             setItemCache(element, i);
             return element;
         }
         i++;
     }
 
     return 0;
 }
 
 void HTMLCollection::updateNameCache() const
 {
     if (hasNameCache())
         return;
 
-    ContainerNode* root = rootContainerNode();
-    if (!root)
-        return;
-
-    for (Element* element = traverseToFirstElement(*root); element; element = traverseNextElement(*element, root)) {
+    ContainerNode& root = rootNode();
+    for (Element* element = traverseToFirstElement(root); element; element = traverseNextElement(*element, root)) {
         const AtomicString& idAttrVal = element->getIdAttribute();
         if (!idAttrVal.isEmpty())
             appendIdCache(idAttrVal, element);
         if (!element->isHTMLElement())
             continue;
         const AtomicString& nameAttrVal = element->getNameAttribute();
         if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal && (type() != DocAll || nameShouldBeVisibleInDocumentAll(toHTMLElement(element))))
             appendNameCache(nameAttrVal, element);
     }
 
@@ skipping 20 matching lines @@
 
 void HTMLCollection::append(NodeCacheMap& map, const AtomicString& key, Element* element)
 {
     OwnPtr<Vector<Element*> >& vector = map.add(key.impl(), nullptr).iterator->value;
     if (!vector)
         vector = adoptPtr(new Vector<Element*>);
     vector->append(element);
 }
 
 } // namespace WebCore