Fix SVGDocument return title that is not a child of the root element

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
@@ skipping 1268 matching lines @@
         m_title = canonicalizedTitle<UChar>(this, m_rawTitle);
 
     if (!m_frame || oldTitle == m_title)
         return;
     m_frame->loader().client()->dispatchDidReceiveTitle(m_title);
 }
 
 void Document::setTitle(const String& title)
 {
     // Title set by JavaScript -- overrides any title elements.
-    if (!isHTMLDocument() && !isXHTMLDocument()) {
+    if (!isHTMLDocument() && !isXHTMLDocument() && !isSVGDocument()) {

[fs, 2016/03/01 15:49:03]

It would probably make sense to just reverse these and get a structure similar
to that in setTitleElement below.

if (!m_titleElement) {
    if (isHTMLDocument() || isXHTMLDocument()) {
        ...
    } else if (isSVGDocument()) {
        ...
    }
} else {
    ...
}

[hyunjunekim2, 2016/03/03 14:06:10]

Done.

         m_titleElement = nullptr;
+    } else if (isSVGDocument()) {
+        if (!m_titleElement) {
+            m_titleElement = SVGTitleElement::create(*this);
+            documentElement()->insertBefore(m_titleElement.get(), documentElement()->firstChild());

[fs, 2016/03/01 15:49:03]

Check that documentElement() exists.

[hyunjunekim2, 2016/03/03 14:06:10]

Done.

+        }
     } else if (!m_titleElement) {
         HTMLElement* headElement = head();
         if (!headElement)
             return;
         m_titleElement = HTMLTitleElement::create(*this);
         headElement->appendChild(m_titleElement.get());
     }
 
-    if (isHTMLTitleElement(m_titleElement))
+    if (isHTMLTitleElement(m_titleElement)) {
         toHTMLTitleElement(m_titleElement)->setText(title);
-    else
+    } else if (isSVGTitleElement(m_titleElement)) {
+        toSVGTitleElement(m_titleElement)->setTextContent(title);

[fs, 2016/03/01 15:49:03]

Don't we need protection against mutation here? (Like HTMLTitleElement::setText)

[hyunjunekim2, 2016/03/03 14:06:10]

Done. made SVGTitleElement::setText that referred to HTMLTitleElement::setText.

+    } else {
         updateTitle(title);
+    }
 }
 
 void Document::setTitleElement(Element* titleElement)
 {
     // Only allow the first title element to change the title -- others have no effect.
     if (m_titleElement && m_titleElement != titleElement) {
         if (isHTMLDocument() || isXHTMLDocument()) {
             m_titleElement = Traversal<HTMLTitleElement>::firstWithin(*this);
         } else if (isSVGDocument()) {
             m_titleElement = Traversal<SVGTitleElement>::firstWithin(*this);
         }
     } else {
         m_titleElement = titleElement;
     }
 
-    if (isHTMLTitleElement(m_titleElement))
+    if (isHTMLTitleElement(m_titleElement)) {
         updateTitle(toHTMLTitleElement(m_titleElement)->text());
-    else if (isSVGTitleElement(m_titleElement))
-        updateTitle(toSVGTitleElement(m_titleElement)->textContent());
+    } else if (isSVGTitleElement(m_titleElement)) {
+        SVGElement* rootElement = toSVGElement(documentElement());

[fs, 2016/03/01 15:49:03]

Dangerous (but unnecessary)

[hyunjunekim2, 2016/03/03 14:06:10]

Done. Removed it.

+        // If the root element is an svg element, the first title element in the SVG namespace

[fs, 2016/03/01 15:49:03]

It looks like a better fit to do this above?

+        // is a child of the root element.
+        bool hasSVGTitle = false;
+        for (SVGElement* child = Traversal<SVGElement>::firstChild(*rootElement); child; child = Traversal<SVGElement>::nextSibling(*child)) {

[fs, 2016/03/01 15:49:03]

This appears to be a very long-winded way of checking if:

isSVGSVGElement(m_titleElement->parentNode())

is true.

[hyunjunekim2, 2016/03/03 14:06:10]

Done.

+            if (child == m_titleElement) {
+                updateTitle(toSVGTitleElement(m_titleElement)->textContent());

[fs, 2016/03/01 15:49:03]

Spec says:

"If the root element is an svg element in the SVG namespace, then let value be a
concatenation of the data of all the child Text nodes of the first title element
in the SVG namespace that is a child of the root element. [SVG]"

which differs from what this does.

[hyunjunekim2, 2016/03/03 14:06:10]

Done. passed document.title-09.html.

+                hasSVGTitle = true;
+                break;
+            }
+        }
+
+        if (!hasSVGTitle)
+            m_titleElement = nullptr;
+    }
 }
 
 void Document::removeTitle(Element* titleElement)
 {
     if (m_titleElement != titleElement)
         return;
 
     m_titleElement = nullptr;
 
     // Update title based on first title element in the document, if one exists.
@@ skipping 4663 matching lines @@
 #ifndef NDEBUG
 using namespace blink;
 void showLiveDocumentInstances()
 {
     Document::WeakDocumentSet& set = Document::liveDocumentSet();
     fprintf(stderr, "There are %u documents currently alive:\n", set.size());
     for (Document* document : set)
         fprintf(stderr, "- Document %p URL: %s\n", document, document->url().string().utf8().data());
 }
 #endif