Safe DOM w/ fixes

tools/dom/templates/html/impl/impl_DocumentFragment.darttemplate

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of $LIBRARYNAME;
 
 $(ANNOTATIONS)$(CLASS_MODIFIERS)class $CLASSNAME$EXTENDS$IMPLEMENTS$NATIVESPEC {
   factory $CLASSNAME() => document.createDocumentFragment();
 
-  factory $CLASSNAME.html(String html) {
-    final fragment = new DocumentFragment();
-    fragment.innerHtml = html;
-    return fragment;
+  factory $CLASSNAME.html(String html,
+      {NodeValidator validator, NodeTreeSanitizer treeSanitizer}) {
+
+    return document.body.createFragment(html,
+      validator: validator, treeSanitizer: treeSanitizer);
   }
 
-  factory $CLASSNAME.svg(String svgContent) {
-    final fragment = new DocumentFragment();
-    final e = new svg.SvgSvgElement();
-    e.innerHtml = svgContent;
+  factory $CLASSNAME.svg(String svgContent,
+      {NodeValidator validator, NodeTreeSanitizer treeSanitizer}) {
 
-    // Copy list first since we don't want liveness during iteration.
-    final List nodes = new List.from(e.nodes);
-    fragment.nodes.addAll(nodes);
-    return fragment;
+    return new svg.SvgSvgElement().createFragment(svgContent,
+        validator: validator, treeSanitizer: treeSanitizer);
   }
 
 $if DART2JS
   // Native field is used only by Dart code so does not lead to instantiation
   // of native classes
   @Creates('Null')
 $endif
   List<Element> _children;
 
   List<Element> get children {
@@ skipping 15 matching lines @@
 
   List<Element> queryAll(String selectors) =>
     new _FrozenElementList._wrap(_querySelectorAll(selectors));
 
   String get innerHtml {
     final e = new Element.tag("div");
     e.append(this.clone(true));
     return e.innerHtml;
   }
 
-  // TODO(nweiz): Do we want to support some variant of innerHtml for XML and/or
-  // SVG strings?
   void set innerHtml(String value) {
+    this.setInnerHtml(value);
+  }
+
+  void setInnerHtml(String html,
+    {NodeValidator validator, NodeTreeSanitizer treeSanitizer}) {
+
     this.nodes.clear();
-
-    final e = new Element.tag("div");
-    e.innerHtml = value;
-
-    // Copy list first since we don't want liveness during iteration.
-    List nodes = new List.from(e.nodes, growable: false);
-    this.nodes.addAll(nodes);
+    append(document.body.createFragment(
+        html, validator: validator, treeSanitizer: treeSanitizer));
   }
 
   /**
    * Adds the specified text as a text node after the last child of this
    * document fragment.
    */
   void appendText(String text) {
     this.append(new Text(text));
   }
 
 
   /**
    * Parses the specified text as HTML and adds the resulting node after the
    * last child of this document fragment.
    */
   void appendHtml(String text) {
     this.append(new DocumentFragment.html(text));
   }
 
 $!MEMBERS
 }