<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[192133] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/192133">192133</a></dd>
<dt>Author</dt> <dd>zalan@apple.com</dd>
<dt>Date</dt> <dd>2015-11-07 16:50:44 -0800 (Sat, 07 Nov 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>Crash when subtree layout is set on FrameView while auto size mode is enabled.
https://bugs.webkit.org/show_bug.cgi?id=150995
rdar://problem/22785262
Reviewed by Beth Dakin.
Autosizing initiates multiple synchronous layouts to calculate preferred view width for current content.
FrameView::autoSizeIfEnabled() is called from FrameView::layout() while we are in InPreLayout state.
It is safe to do during full layout.
However, since we setup the subtree state just before the autoSizeIfEnabled() call, reentering it with
a newly issued layout confuses SubtreeLayoutStateMaintainer.
This patch reverses the order of autoSizeIfEnabled() call and the subtree layout state setup.
It also ensures that the first layout requested by autoSizeIfEnabled() always runs on the whole tree.
Source/WebCore:
Test: fast/dynamic/crash-subtree-layout-when-auto-size-enabled.html
* page/FrameView.cpp:
(WebCore::FrameView::layout):
(WebCore::FrameView::convertSubtreeLayoutToFullLayout):
(WebCore::FrameView::scheduleRelayout):
(WebCore::FrameView::scheduleRelayoutOfSubtree):
(WebCore::FrameView::autoSizeIfEnabled):
* page/FrameView.h:
* testing/Internals.cpp:
(WebCore::Internals::enableAutoSizeMode):
* testing/Internals.h:
* testing/Internals.idl:
LayoutTests:
* fast/dynamic/crash-subtree-layout-when-auto-size-enabled-expected.txt: Added.
* fast/dynamic/crash-subtree-layout-when-auto-size-enabled.html: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorepageFrameViewcpp">trunk/Source/WebCore/page/FrameView.cpp</a></li>
<li><a href="#trunkSourceWebCorepageFrameViewh">trunk/Source/WebCore/page/FrameView.h</a></li>
<li><a href="#trunkSourceWebCoretestingInternalscpp">trunk/Source/WebCore/testing/Internals.cpp</a></li>
<li><a href="#trunkSourceWebCoretestingInternalsh">trunk/Source/WebCore/testing/Internals.h</a></li>
<li><a href="#trunkSourceWebCoretestingInternalsidl">trunk/Source/WebCore/testing/Internals.idl</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastdynamiccrashsubtreelayoutwhenautosizeenabledexpectedtxt">trunk/LayoutTests/fast/dynamic/crash-subtree-layout-when-auto-size-enabled-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdynamiccrashsubtreelayoutwhenautosizeenabledhtml">trunk/LayoutTests/fast/dynamic/crash-subtree-layout-when-auto-size-enabled.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (192132 => 192133)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2015-11-07 23:48:08 UTC (rev 192132)
+++ trunk/LayoutTests/ChangeLog 2015-11-08 00:50:44 UTC (rev 192133)
</span><span class="lines">@@ -1,3 +1,23 @@
</span><ins>+2015-11-07 Zalan Bujtas <zalan@apple.com>
+
+ Crash when subtree layout is set on FrameView while auto size mode is enabled.
+ https://bugs.webkit.org/show_bug.cgi?id=150995
+ rdar://problem/22785262
+
+ Reviewed by Beth Dakin.
+
+ Autosizing initiates multiple synchronous layouts to calculate preferred view width for current content.
+ FrameView::autoSizeIfEnabled() is called from FrameView::layout() while we are in InPreLayout state.
+ It is safe to do during full layout.
+ However, since we setup the subtree state just before the autoSizeIfEnabled() call, reentering it with
+ a newly issued layout confuses SubtreeLayoutStateMaintainer.
+
+ This patch reverses the order of autoSizeIfEnabled() call and the subtree layout state setup.
+ It also ensures that the first layout requested by autoSizeIfEnabled() always runs on the whole tree.
+
+ * fast/dynamic/crash-subtree-layout-when-auto-size-enabled-expected.txt: Added.
+ * fast/dynamic/crash-subtree-layout-when-auto-size-enabled.html: Added.
+
</ins><span class="cx"> 2015-11-07 Chris Dumez <cdumez@apple.com>
</span><span class="cx">
</span><span class="cx"> embed element without src and type attributes should represent nothing
</span></span></pre></div>
<a id="trunkLayoutTestsfastdynamiccrashsubtreelayoutwhenautosizeenabledexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dynamic/crash-subtree-layout-when-auto-size-enabled-expected.txt (0 => 192133)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dynamic/crash-subtree-layout-when-auto-size-enabled-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dynamic/crash-subtree-layout-when-auto-size-enabled-expected.txt 2015-11-08 00:50:44 UTC (rev 192133)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+Pass if no crash or assert.
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdynamiccrashsubtreelayoutwhenautosizeenabledhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dynamic/crash-subtree-layout-when-auto-size-enabled.html (0 => 192133)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dynamic/crash-subtree-layout-when-auto-size-enabled.html (rev 0)
+++ trunk/LayoutTests/fast/dynamic/crash-subtree-layout-when-auto-size-enabled.html 2015-11-08 00:50:44 UTC (rev 192133)
</span><span class="lines">@@ -0,0 +1,32 @@
</span><ins>+<!DOCTYPE HTML>
+<html>
+<head>
+<title>This tests that we don't crash in autosize mode with subtree layout.</title>
+<style>
+ div {
+ position: absolute;
+ overflow: hidden;
+ width: 10px;
+ height: 10px;
+ }
+</style>
+</head>
+<body>
+<div>Pass if no crash or assert.<div id=resizeThis></div></div>
+<script>
+if (window.internals)
+ internals.enableAutoSizeMode(true, 10, 10, 1000, 1000);
+
+if (window.testRunner) {
+ testRunner.waitUntilDone();
+ testRunner.dumpAsText();
+}
+
+setTimeout(function() {
+ document.getElementById("resizeThis").style.width = "20px";
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }, 0);
+</script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (192132 => 192133)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2015-11-07 23:48:08 UTC (rev 192132)
+++ trunk/Source/WebCore/ChangeLog 2015-11-08 00:50:44 UTC (rev 192133)
</span><span class="lines">@@ -1,3 +1,34 @@
</span><ins>+2015-11-07 Zalan Bujtas <zalan@apple.com>
+
+ Crash when subtree layout is set on FrameView while auto size mode is enabled.
+ https://bugs.webkit.org/show_bug.cgi?id=150995
+ rdar://problem/22785262
+
+ Reviewed by Beth Dakin.
+
+ Autosizing initiates multiple synchronous layouts to calculate preferred view width for current content.
+ FrameView::autoSizeIfEnabled() is called from FrameView::layout() while we are in InPreLayout state.
+ It is safe to do during full layout.
+ However, since we setup the subtree state just before the autoSizeIfEnabled() call, reentering it with
+ a newly issued layout confuses SubtreeLayoutStateMaintainer.
+
+ This patch reverses the order of autoSizeIfEnabled() call and the subtree layout state setup.
+ It also ensures that the first layout requested by autoSizeIfEnabled() always runs on the whole tree.
+
+ Test: fast/dynamic/crash-subtree-layout-when-auto-size-enabled.html
+
+ * page/FrameView.cpp:
+ (WebCore::FrameView::layout):
+ (WebCore::FrameView::convertSubtreeLayoutToFullLayout):
+ (WebCore::FrameView::scheduleRelayout):
+ (WebCore::FrameView::scheduleRelayoutOfSubtree):
+ (WebCore::FrameView::autoSizeIfEnabled):
+ * page/FrameView.h:
+ * testing/Internals.cpp:
+ (WebCore::Internals::enableAutoSizeMode):
+ * testing/Internals.h:
+ * testing/Internals.idl:
+
</ins><span class="cx"> 2015-11-07 Chris Dumez <cdumez@apple.com>
</span><span class="cx">
</span><span class="cx"> embed element without src and type attributes should represent nothing
</span></span></pre></div>
<a id="trunkSourceWebCorepageFrameViewcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/FrameView.cpp (192132 => 192133)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/FrameView.cpp 2015-11-07 23:48:08 UTC (rev 192132)
+++ trunk/Source/WebCore/page/FrameView.cpp 2015-11-08 00:50:44 UTC (rev 192133)
</span><span class="lines">@@ -1259,10 +1259,8 @@
</span><span class="cx"> InspectorInstrumentationCookie cookie = InspectorInstrumentation::willLayout(frame());
</span><span class="cx"> AnimationUpdateBlock animationUpdateBlock(&frame().animation());
</span><span class="cx">
</span><del>- if (!allowSubtree && m_layoutRoot) {
- m_layoutRoot->markContainingBlocksForLayout(ScheduleRelayout::No);
- m_layoutRoot = nullptr;
- }
</del><ins>+ if (!allowSubtree && m_layoutRoot)
+ convertSubtreeLayoutToFullLayout();
</ins><span class="cx">
</span><span class="cx"> ASSERT(frame().view() == this);
</span><span class="cx"> ASSERT(frame().document());
</span><span class="lines">@@ -1270,9 +1268,6 @@
</span><span class="cx"> Document& document = *frame().document();
</span><span class="cx"> ASSERT(!document.inPageCache());
</span><span class="cx">
</span><del>- bool subtree;
- RenderElement* root;
-
</del><span class="cx"> {
</span><span class="cx"> TemporaryChange<bool> changeSchedulingEnabled(m_layoutSchedulingEnabled, false);
</span><span class="cx">
</span><span class="lines">@@ -1302,33 +1297,34 @@
</span><span class="cx"> // Always ensure our style info is up-to-date. This can happen in situations where
</span><span class="cx"> // the layout beats any sort of style recalc update that needs to occur.
</span><span class="cx"> document.updateStyleIfNeeded();
</span><del>- m_layoutPhase = InPreLayout;
-
- subtree = m_layoutRoot;
-
- // If there is only one ref to this view left, then its going to be destroyed as soon as we exit,
</del><ins>+ // If there is only one ref to this view left, then its going to be destroyed as soon as we exit,
</ins><span class="cx"> // so there's no point to continuing to layout
</span><span class="cx"> if (hasOneRef())
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- root = subtree ? m_layoutRoot : document.renderView();
- if (!root) {
- // FIXME: Do we need to set m_size here?
- return;
- }
-
</del><span class="cx"> // Close block here so we can set up the font cache purge preventer, which we will still
</span><span class="cx"> // want in scope even after we want m_layoutSchedulingEnabled to be restored again.
</span><span class="cx"> // The next block sets m_layoutSchedulingEnabled back to false once again.
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RenderLayer* layer;
</del><ins>+ m_layoutPhase = InPreLayout;
</ins><span class="cx">
</span><ins>+ RenderLayer* layer = nullptr;
+ bool subtree = false;
+ RenderElement* root = nullptr;
+
</ins><span class="cx"> ++m_nestedLayoutCount;
</span><span class="cx">
</span><span class="cx"> {
</span><span class="cx"> TemporaryChange<bool> changeSchedulingEnabled(m_layoutSchedulingEnabled, false);
</span><span class="cx">
</span><ins>+ autoSizeIfEnabled();
+
+ root = m_layoutRoot ? m_layoutRoot : document.renderView();
+ if (!root)
+ return;
+ subtree = m_layoutRoot;
+
</ins><span class="cx"> if (!m_layoutRoot) {
</span><span class="cx"> auto* body = document.bodyOrFrameset();
</span><span class="cx"> if (body && body->renderer()) {
</span><span class="lines">@@ -1343,11 +1339,9 @@
</span><span class="cx"> #ifdef INSTRUMENT_LAYOUT_SCHEDULING
</span><span class="cx"> if (m_firstLayout && !frame().ownerElement())
</span><span class="cx"> printf("Elapsed time before first layout: %lld\n", document.elapsedTime().count());
</span><del>-#endif
</del><ins>+#endif
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- autoSizeIfEnabled();
-
</del><span class="cx"> m_needsFullRepaint = !subtree && (m_firstLayout || downcast<RenderView>(*root).printing());
</span><span class="cx">
</span><span class="cx"> if (!subtree) {
</span><span class="lines">@@ -2567,6 +2561,12 @@
</span><span class="cx"> adjustTiledBackingCoverage();
</span><span class="cx"> }
</span><span class="cx"> }
</span><ins>+void FrameView::convertSubtreeLayoutToFullLayout()
+{
+ ASSERT(m_layoutRoot);
+ m_layoutRoot->markContainingBlocksForLayout(ScheduleRelayout::No);
+ m_layoutRoot = nullptr;
+}
</ins><span class="cx">
</span><span class="cx"> void FrameView::layoutTimerFired()
</span><span class="cx"> {
</span><span class="lines">@@ -2583,10 +2583,8 @@
</span><span class="cx"> // too many false assertions. See <rdar://problem/7218118>.
</span><span class="cx"> ASSERT(frame().view() == this);
</span><span class="cx">
</span><del>- if (m_layoutRoot) {
- m_layoutRoot->markContainingBlocksForLayout(ScheduleRelayout::No);
- m_layoutRoot = nullptr;
- }
</del><ins>+ if (m_layoutRoot)
+ convertSubtreeLayoutToFullLayout();
</ins><span class="cx"> if (!m_layoutSchedulingEnabled)
</span><span class="cx"> return;
</span><span class="cx"> if (!needsLayout())
</span><span class="lines">@@ -2675,8 +2673,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // Just do a full relayout.
</span><del>- m_layoutRoot->markContainingBlocksForLayout(ScheduleRelayout::No);
- m_layoutRoot = nullptr;
</del><ins>+ convertSubtreeLayoutToFullLayout();
</ins><span class="cx"> newRelayoutRoot.markContainingBlocksForLayout(ScheduleRelayout::No);
</span><span class="cx"> InspectorInstrumentation::didInvalidateLayout(frame());
</span><span class="cx"> }
</span><span class="lines">@@ -3219,6 +3216,8 @@
</span><span class="cx"> if (!documentView || !documentElement)
</span><span class="cx"> return;
</span><span class="cx">
</span><ins>+ if (m_layoutRoot)
+ convertSubtreeLayoutToFullLayout();
</ins><span class="cx"> // Start from the minimum size and allow it to grow.
</span><span class="cx"> resize(m_minAutoSize.width(), m_minAutoSize.height());
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCorepageFrameViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/FrameView.h (192132 => 192133)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/FrameView.h 2015-11-07 23:48:08 UTC (rev 192132)
+++ trunk/Source/WebCore/page/FrameView.h 2015-11-08 00:50:44 UTC (rev 192133)
</span><span class="lines">@@ -677,6 +677,8 @@
</span><span class="cx"> void removeFromAXObjectCache();
</span><span class="cx"> void notifyWidgets(WidgetNotification);
</span><span class="cx">
</span><ins>+ void convertSubtreeLayoutToFullLayout();
+
</ins><span class="cx"> RenderElement* viewportRenderer() const;
</span><span class="cx">
</span><span class="cx"> HashSet<Widget*> m_widgetsInRenderTree;
</span></span></pre></div>
<a id="trunkSourceWebCoretestingInternalscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/testing/Internals.cpp (192132 => 192133)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/testing/Internals.cpp 2015-11-07 23:48:08 UTC (rev 192132)
+++ trunk/Source/WebCore/testing/Internals.cpp 2015-11-08 00:50:44 UTC (rev 192133)
</span><span class="lines">@@ -2440,6 +2440,14 @@
</span><span class="cx"> frame()->loader().reload(endToEnd);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void Internals::enableAutoSizeMode(bool enabled, int minimumWidth, int minimumHeight, int maximumWidth, int maximumHeight)
+{
+ Document* document = contextDocument();
+ if (!document || !document->view())
+ return;
+ document->view()->enableAutoSizeMode(enabled, IntSize(minimumWidth, minimumHeight), IntSize(maximumWidth, maximumHeight));
+}
+
</ins><span class="cx"> #if ENABLE(ENCRYPTED_MEDIA_V2)
</span><span class="cx"> void Internals::initializeMockCDM()
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceWebCoretestingInternalsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/testing/Internals.h (192132 => 192133)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/testing/Internals.h 2015-11-07 23:48:08 UTC (rev 192132)
+++ trunk/Source/WebCore/testing/Internals.h 2015-11-08 00:50:44 UTC (rev 192133)
</span><span class="lines">@@ -336,6 +336,8 @@
</span><span class="cx">
</span><span class="cx"> void forceReload(bool endToEnd);
</span><span class="cx">
</span><ins>+ void enableAutoSizeMode(bool enabled, int minimumWidth, int minimumHeight, int maximumWidth, int maximumHeight);
+
</ins><span class="cx"> #if ENABLE(ENCRYPTED_MEDIA_V2)
</span><span class="cx"> void initializeMockCDM();
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkSourceWebCoretestingInternalsidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/testing/Internals.idl (192132 => 192133)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/testing/Internals.idl 2015-11-07 23:48:08 UTC (rev 192132)
+++ trunk/Source/WebCore/testing/Internals.idl 2015-11-08 00:50:44 UTC (rev 192133)
</span><span class="lines">@@ -329,6 +329,8 @@
</span><span class="cx">
</span><span class="cx"> void forceReload(boolean endToEnd);
</span><span class="cx">
</span><ins>+ void enableAutoSizeMode(boolean enabled, long minimumWidth, long minimumHeight, long maximumWidth, long maximumHeight);
+
</ins><span class="cx"> [Conditional=VIDEO] void simulateAudioInterruption(Node node);
</span><span class="cx"> [Conditional=VIDEO, RaisesException] boolean mediaElementHasCharacteristic(Node node, DOMString characteristic);
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>