2nd arg of document.createElement should be an object

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
@@ skipping 10 matching lines @@
  *
  * You should have received a copy of the GNU Library General Public License
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
 
 #include "core/dom/Document.h"
 
 #include "bindings/core/v8/DOMDataStore.h"
+#include "bindings/core/v8/ElementCreationOptionsOrString.h"
 #include "bindings/core/v8/ExceptionMessages.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ExceptionStatePlaceholder.h"
 #include "bindings/core/v8/HTMLScriptElementOrSVGScriptElement.h"
 #include "bindings/core/v8/Microtask.h"
 #include "bindings/core/v8/ScriptController.h"
 #include "bindings/core/v8/SourceLocation.h"
 #include "bindings/core/v8/V0CustomElementConstructorBuilder.h"
 #include "bindings/core/v8/V8DOMWrapper.h"
 #include "bindings/core/v8/V8PerIsolateData.h"
@@ skipping 25 matching lines @@
 #include "core/dom/Attr.h"
 #include "core/dom/CDATASection.h"
 #include "core/dom/ClientRect.h"
 #include "core/dom/Comment.h"
 #include "core/dom/ContextFeatures.h"
 #include "core/dom/DOMImplementation.h"
 #include "core/dom/DocumentFragment.h"
 #include "core/dom/DocumentParserTiming.h"
 #include "core/dom/DocumentType.h"
 #include "core/dom/Element.h"
+#include "core/dom/ElementCreationOptions.h"
 #include "core/dom/ElementDataCache.h"
 #include "core/dom/ElementRegistrationOptions.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/ExecutionContextTask.h"
 #include "core/dom/FrameRequestCallback.h"
 #include "core/dom/IntersectionObserverController.h"
 #include "core/dom/LayoutTreeBuilderTraversal.h"
 #include "core/dom/MainThreadTaskRunner.h"
 #include "core/dom/MutationObserver.h"
@@ skipping 567 matching lines @@
 
     if (isXHTMLDocument() || isHTMLDocument()) {
         if (CustomElement::shouldCreateCustomElement(name))
             return CustomElement::createCustomElementSync(*this, name, exceptionState);
         return HTMLElementFactory::createHTMLElement(convertLocalName(name), *this, 0, CreatedByCreateElement);
     }
 
     return Element::create(QualifiedName(nullAtom, name, nullAtom), this);
 }
 
-Element* Document::createElement(const AtomicString& localName, const AtomicString& typeExtension, ExceptionState& exceptionState)
+Element* Document::createElement(const AtomicString& localName, const ElementCreationOptionsOrString& optionsOrString, ExceptionState& exceptionState)
 {
     if (!isValidName(localName)) {
         exceptionState.throwDOMException(InvalidCharacterError, "The tag name provided ('" + localName + "') is not a valid name.");
         return nullptr;
     }
 
     Element* element;
 
     if (CustomElement::shouldCreateCustomElement(localName)) {
         element = CustomElement::createCustomElementSync(*this, localName, exceptionState);
     } else if (V0CustomElement::isValidName(localName) && registrationContext()) {
         element = registrationContext()->createCustomTagElement(*this, QualifiedName(nullAtom, convertLocalName(localName), xhtmlNamespaceURI));
     } else {
         element = createElement(localName, exceptionState);
         if (exceptionState.hadException())
             return nullptr;
     }
 
-    if (!typeExtension.isEmpty())
-        V0CustomElementRegistrationContext::setIsAttributeAndTypeExtension(element, typeExtension);
+    if (optionsOrString.isString() && !optionsOrString.getAsString().isEmpty()) {

[dominicc (has gone to gerrit), 2016/09/15 01:19:24]

I wonder if the existing code does toString on non-string arguments. Could you
check, maybe by writing tests, with an object argument that does not have
extends but toString returns something to extend?

For example, I think this alerts true, but your change will send it down the
'is' path:

http://jsbin.com/mikuyomogu/edit?html,output

<!DOCTYPE html>
<script>
FooBar = document.registerElement('foo-bar', {extends: 'button'});
var elem = document.createElement('button', {toString: () => 'foo-bar'});
alert(elem.constructor === FooBar);
</script>

[Anton Obzhirov, 2016/09/15 09:25:20]

Will check, good point, will need to figure out how to handle this case :)

+        V0CustomElementRegistrationContext::setIsAttributeAndTypeExtension(element, AtomicString(optionsOrString.getAsString()));
+        Deprecation::countDeprecation(this, UseCounter::DocumentCreateElement2ndArg);
+    } else if (optionsOrString.isElementCreationOptions() && !optionsOrString.getAsElementCreationOptions().is().isEmpty()) {
+        V0CustomElementRegistrationContext::setIsAttributeAndTypeExtension(element, AtomicString(optionsOrString.getAsElementCreationOptions().is()));
+    }
 
     return element;
 }
 
 static inline QualifiedName createQualifiedName(const AtomicString& namespaceURI, const AtomicString& qualifiedName, ExceptionState& exceptionState)
 {
     AtomicString prefix, localName;
     if (!Document::parseQualifiedName(qualifiedName, prefix, localName, exceptionState))
         return QualifiedName::null();
 
@@ skipping 10 matching lines @@
 {
     QualifiedName qName(createQualifiedName(namespaceURI, qualifiedName, exceptionState));
     if (qName == QualifiedName::null())
         return nullptr;
 
     if (CustomElement::shouldCreateCustomElement(qName))
         return CustomElement::createCustomElementSync(*this, qName, exceptionState);
     return createElement(qName, CreatedByCreateElement);
 }
 
-Element* Document::createElementNS(const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& typeExtension, ExceptionState& exceptionState)
+Element* Document::createElementNS(const AtomicString& namespaceURI, const AtomicString& qualifiedName, const ElementCreationOptionsOrString& optionsOrString, ExceptionState& exceptionState)
 {
     QualifiedName qName(createQualifiedName(namespaceURI, qualifiedName, exceptionState));
     if (qName == QualifiedName::null())
         return nullptr;
 
     Element* element;
     if (CustomElement::shouldCreateCustomElement(qName))
         element = CustomElement::createCustomElementSync(*this, qName, exceptionState);
     else if (V0CustomElement::isValidName(qName.localName()) && registrationContext())
         element = registrationContext()->createCustomTagElement(*this, qName);
     else
         element = createElement(qName, CreatedByCreateElement);
 
-    if (!typeExtension.isEmpty())
-        V0CustomElementRegistrationContext::setIsAttributeAndTypeExtension(element, typeExtension);
+    if (optionsOrString.isString() && !optionsOrString.getAsString().isEmpty()) {
+        V0CustomElementRegistrationContext::setIsAttributeAndTypeExtension(element, AtomicString(optionsOrString.getAsString()));
+        Deprecation::countDeprecation(this, UseCounter::DocumentCreateElement2ndArg);
+    } else if (optionsOrString.isElementCreationOptions() && !optionsOrString.getAsElementCreationOptions().is().isEmpty()) {
+        V0CustomElementRegistrationContext::setIsAttributeAndTypeExtension(element, AtomicString(optionsOrString.getAsElementCreationOptions().is()));
+    }
 
     return element;
 }
 
 ScriptValue Document::registerElement(ScriptState* scriptState, const AtomicString& name, const ElementRegistrationOptions& options, ExceptionState& exceptionState, V0CustomElement::NameSet validNames)
 {
     HostsUsingFeatures::countMainWorldOnly(scriptState, *this, HostsUsingFeatures::Feature::DocumentRegisterElement);
 
     if (!registrationContext()) {
         exceptionState.throwDOMException(NotSupportedError, "No element registration context is available.");
@@ skipping 5349 matching lines @@
 }
 
 void showLiveDocumentInstances()
 {
     WeakDocumentSet& set = liveDocumentSet();
     fprintf(stderr, "There are %u documents currently alive:\n", set.size());
     for (Document* document : set)
         fprintf(stderr, "- Document %p URL: %s\n", document, document->url().getString().utf8().data());
 }
 #endif