[Webkit-unassigned] [Bug 124145] New: innerHTML is corrupting DOM tree

Mon Nov 11 06:32:47 PST 2013

https://bugs.webkit.org/show_bug.cgi?id=124145

           Summary: innerHTML is corrupting DOM tree
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: yannick.poirier at inverto.tv

The following test fails with the error
line 14:41 : TypeError: null is not an object (evaluating 'frame.children[i].firstChild.innerHTML = "test"')
The DOM tree seems to be corrupted after an innerHTML.

<html>
<head></head>
<body>
    <div id="frame">
        <div><div></div></div>
        <div><div></div></div>
        <div><div></div></div>
        <div><div></div></div>
        <div><div></div></div>
    </div>
    <script type="text/javascript">
        frame = document.getElementById("frame");
        for (var i = 0; i < frame.children.length; i++)
            frame.children[i].firstChild.innerHTML = "test";
    </script>
</body>
</html>

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.