Make sure the rootNode of a LiveNodeListBase is always a ContainerNode

Source/core/html/HTMLCollection.cpp

Index: Source/core/html/HTMLCollection.cpp
diff --git a/Source/core/html/HTMLCollection.cpp b/Source/core/html/HTMLCollection.cpp
index 58cb3273027204ee8ae560e1c6e87e179562c1c5..4e51991e6bbae2c52e6778bfce20d8b2d23709f5 100644
--- a/Source/core/html/HTMLCollection.cpp
+++ b/Source/core/html/HTMLCollection.cpp
@@ -160,7 +160,7 @@ static NodeListInvalidationType invalidationTypeExcludingIdAndNameAttributes(Col
     return DoNotInvalidateOnAttributeChanges;
 }
 
-HTMLCollection::HTMLCollection(Node* ownerNode, CollectionType type, ItemAfterOverrideType itemAfterOverrideType)
+HTMLCollection::HTMLCollection(ContainerNode* ownerNode, CollectionType type, ItemAfterOverrideType itemAfterOverrideType)
     : LiveNodeListBase(ownerNode, rootTypeFromCollectionType(type), invalidationTypeExcludingIdAndNameAttributes(type),
         WebCore::shouldOnlyIncludeDirectChildren(type), type, itemAfterOverrideType)
     , m_isNameCacheValid(false)
@@ -168,7 +168,7 @@ HTMLCollection::HTMLCollection(Node* ownerNode, CollectionType type, ItemAfterOv
     ScriptWrappable::init(this);
 }
 
-PassRefPtr<HTMLCollection> HTMLCollection::create(Node* base, CollectionType type)
+PassRefPtr<HTMLCollection> HTMLCollection::create(ContainerNode* base, CollectionType type)
 {
     return adoptRef(new HTMLCollection(base, type, DoesNotOverrideItemAfter));
 }
@@ -322,17 +322,17 @@ inline Element* firstMatchingElement(const NodeListType* nodeList, ContainerNode
 }
 
 template <class NodeListType>
-inline Element* nextMatchingElement(const NodeListType* nodeList, Element& current, ContainerNode* root)
+inline Element* nextMatchingElement(const NodeListType* nodeList, Element& current, ContainerNode& root)
 {
     Element* next = &current;
     do {
-        next = ElementTraversal::next(*next, root);
+        next = ElementTraversal::next(*next, &root);
     } while (next && !isMatchingElement(nodeList, next));
     return next;
 }
 
 template <class NodeListType>
-inline Element* traverseMatchingElementsForwardToOffset(const NodeListType* nodeList, unsigned offset, Element& currentElement, unsigned& currentOffset, ContainerNode* root)
+inline Element* traverseMatchingElementsForwardToOffset(const NodeListType* nodeList, unsigned offset, Element& currentElement, unsigned& currentOffset, ContainerNode& root)
 {
     ASSERT(currentOffset < offset);
     Element* next = &currentElement;
@@ -373,7 +373,7 @@ inline Node* LiveNodeList::traverseToFirstElement(ContainerNode& root) const
 
 // FIXME: This should be in LiveNodeList.cpp but it needs to stay here until traverseMatchingElementsForwardToOffset()
 // and others are moved to a separate header.
-inline Node* LiveNodeList::traverseForwardToOffset(unsigned offset, Node& currentNode, unsigned& currentOffset, ContainerNode* root) const
+inline Node* LiveNodeList::traverseForwardToOffset(unsigned offset, Node& currentNode, unsigned& currentOffset, ContainerNode& root) const
 {
     switch (type()) {
     case ChildNodeListType:
@@ -427,13 +427,7 @@ Node* LiveNodeListBase::item(unsigned offset) const
     if (isLengthCacheValid() && cachedLength() <= offset)
         return 0;
 
-    ContainerNode* root = rootContainerNode();
-    if (!root) {
-        // FIMXE: In someTextNode.childNodes case the root is Text. We shouldn't even make a LiveNodeList for that.
-        setLengthCache(0);
-        return 0;
-    }
-
+    ContainerNode& root = rootNode();
     if (isLengthCacheValid() && !overridesItemAfter() && isLastItemCloserThanLastOrCachedItem(offset)) {
         Node* lastItem = itemBefore(0);
         ASSERT(lastItem);
@@ -441,9 +435,9 @@ Node* LiveNodeListBase::item(unsigned offset) const
     } else if (!isItemCacheValid() || isFirstItemCloserThanCachedItem(offset) || (overridesItemAfter() && offset < cachedItemOffset())) {
         Node* firstItem;
         if (isLiveNodeListType(type()))
-            firstItem = static_cast<const LiveNodeList*>(this)->traverseToFirstElement(*root);
+            firstItem = static_cast<const LiveNodeList*>(this)->traverseToFirstElement(root);
         else
-            firstItem = static_cast<const HTMLCollection*>(this)->traverseToFirstElement(*root);
+            firstItem = static_cast<const HTMLCollection*>(this)->traverseToFirstElement(root);
 
         if (!firstItem) {
             setLengthCache(0);
@@ -459,7 +453,7 @@ Node* LiveNodeListBase::item(unsigned offset) const
     return itemBeforeOrAfterCachedItem(offset, root);
 }
 
-inline Node* LiveNodeListBase::itemBeforeOrAfterCachedItem(unsigned offset, ContainerNode* root) const
+inline Node* LiveNodeListBase::itemBeforeOrAfterCachedItem(unsigned offset, ContainerNode& root) const
 {
     unsigned currentOffset = cachedItemOffset();
     Node* currentItem = cachedItem();
@@ -536,11 +530,11 @@ inline Element* firstMatchingChildElement(const HTMLCollection* nodeList, Contai
     return element;
 }
 
-inline Element* nextMatchingChildElement(const HTMLCollection* nodeList, Element& current, ContainerNode* root)
+inline Element* nextMatchingChildElement(const HTMLCollection* nodeList, Element& current, ContainerNode& root)
 {
     Element* next = &current;
     do {
-        next = ElementTraversal::nextSkippingChildren(*next, root);
+        next = ElementTraversal::nextSkippingChildren(*next, &root);
     } while (next && !isMatchingElement(nodeList, next));
     return next;
 }
@@ -554,7 +548,7 @@ inline Element* HTMLCollection::traverseToFirstElement(ContainerNode& root) cons
     return firstMatchingElement(static_cast<const HTMLCollection*>(this), root);
 }
 
-inline Element* HTMLCollection::traverseNextElement(Element& previous, ContainerNode* root) const
+inline Element* HTMLCollection::traverseNextElement(Element& previous, ContainerNode& root) const
 {
     if (overridesItemAfter())
         return virtualItemAfter(&previous);
@@ -563,7 +557,7 @@ inline Element* HTMLCollection::traverseNextElement(Element& previous, Container
     return nextMatchingElement(this, previous, root);
 }
 
-inline Element* HTMLCollection::traverseForwardToOffset(unsigned offset, Element& currentElement, unsigned& currentOffset, ContainerNode* root) const
+inline Element* HTMLCollection::traverseForwardToOffset(unsigned offset, Element& currentElement, unsigned& currentOffset, ContainerNode& root) const
 {
     ASSERT(currentOffset < offset);
     if (overridesItemAfter()) {
@@ -593,12 +587,9 @@ Node* HTMLCollection::namedItem(const AtomicString& name) const
     // object with a matching name attribute, but only on those elements
     // that are allowed a name attribute.
 
-    ContainerNode* root = rootContainerNode();
-    if (!root)
-        return 0;
-
+    ContainerNode& root = rootNode();
     unsigned i = 0;
-    for (Element* element = traverseToFirstElement(*root); element; element = traverseNextElement(*element, root)) {
+    for (Element* element = traverseToFirstElement(root); element; element = traverseNextElement(*element, root)) {
         if (checkForNameMatch(element, /* checkName */ false, name)) {
             setItemCache(element, i);
             return element;
@@ -607,7 +598,7 @@ Node* HTMLCollection::namedItem(const AtomicString& name) const
     }
 
     i = 0;
-    for (Element* element = traverseToFirstElement(*root); element; element = traverseNextElement(*element, root)) {
+    for (Element* element = traverseToFirstElement(root); element; element = traverseNextElement(*element, root)) {
         if (checkForNameMatch(element, /* checkName */ true, name)) {
             setItemCache(element, i);
             return element;
@@ -623,11 +614,8 @@ void HTMLCollection::updateNameCache() const
     if (hasNameCache())
         return;
 
-    ContainerNode* root = rootContainerNode();
-    if (!root)
-        return;
-
-    for (Element* element = traverseToFirstElement(*root); element; element = traverseNextElement(*element, root)) {
+    ContainerNode& root = rootNode();
+    for (Element* element = traverseToFirstElement(root); element; element = traverseNextElement(*element, root)) {
         const AtomicString& idAttrVal = element->getIdAttribute();
         if (!idAttrVal.isEmpty())
             appendIdCache(idAttrVal, element);