Title: [108311] trunk
- Revision
- 108311
- Author
- [email protected]
- Date
- 2012-02-20 23:32:52 -0800 (Mon, 20 Feb 2012)
Log Message
Invalid cast in WebCore::toElement / WebCore::HTMLElementStack::ElementRecord::element
https://bugs.webkit.org/show_bug.cgi?id=78975
Reviewed by Eric Seidel.
Source/WebCore:
We're supposed to set the action attribute on the form element we just
created. Previously, we assumed the newly created form element would
be on the top of the stack of open elements, but if we're in the table
body insertion mode, the form element gets treated as self closing and
is therefore popped off the stack of open elements.
Fortunately, we already cache a pointer to the most recently inserted
form element on the HTMLConstructionSite, so we can just grab the
element from there.
Test: html5lib/runner.html
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::processIsindexStartTagForInBody):
(WebCore):
LayoutTests:
* html5lib/resourcesl/webkit-02.dat:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (108310 => 108311)
--- trunk/LayoutTests/ChangeLog 2012-02-21 07:07:21 UTC (rev 108310)
+++ trunk/LayoutTests/ChangeLog 2012-02-21 07:32:52 UTC (rev 108311)
@@ -1,3 +1,12 @@
+2012-02-20 Adam Barth <[email protected]>
+
+ Invalid cast in WebCore::toElement / WebCore::HTMLElementStack::ElementRecord::element
+ https://bugs.webkit.org/show_bug.cgi?id=78975
+
+ Reviewed by Eric Seidel.
+
+ * html5lib/resourcesl/webkit-02.dat:
+
2012-02-20 Csaba Osztrogonác <[email protected]>
[Qt] Unreviewed gardening after r108259.
Modified: trunk/LayoutTests/html5lib/resources/webkit02.dat (108310 => 108311)
--- trunk/LayoutTests/html5lib/resources/webkit02.dat 2012-02-21 07:07:21 UTC (rev 108310)
+++ trunk/LayoutTests/html5lib/resources/webkit02.dat 2012-02-21 07:32:52 UTC (rev 108311)
@@ -134,3 +134,18 @@
| <aside>
| <em>
| <b>
+
+#data
+<isindex action=""
+#errors
+#document-fragment
+table
+#document
+| <form>
+| action=""
+| <hr>
+| <label>
+| "This is a searchable index. Enter search keywords: "
+| <input>
+| name="isindex"
+| <hr>
Modified: trunk/Source/WebCore/ChangeLog (108310 => 108311)
--- trunk/Source/WebCore/ChangeLog 2012-02-21 07:07:21 UTC (rev 108310)
+++ trunk/Source/WebCore/ChangeLog 2012-02-21 07:32:52 UTC (rev 108311)
@@ -1,5 +1,28 @@
2012-02-20 Adam Barth <[email protected]>
+ Invalid cast in WebCore::toElement / WebCore::HTMLElementStack::ElementRecord::element
+ https://bugs.webkit.org/show_bug.cgi?id=78975
+
+ Reviewed by Eric Seidel.
+
+ We're supposed to set the action attribute on the form element we just
+ created. Previously, we assumed the newly created form element would
+ be on the top of the stack of open elements, but if we're in the table
+ body insertion mode, the form element gets treated as self closing and
+ is therefore popped off the stack of open elements.
+
+ Fortunately, we already cache a pointer to the most recently inserted
+ form element on the HTMLConstructionSite, so we can just grab the
+ element from there.
+
+ Test: html5lib/runner.html
+
+ * html/parser/HTMLTreeBuilder.cpp:
+ (WebCore::HTMLTreeBuilder::processIsindexStartTagForInBody):
+ (WebCore):
+
+2012-02-20 Adam Barth <[email protected]>
+
Unite TextTrack-related files with their friends in WebCore/html/track
https://bugs.webkit.org/show_bug.cgi?id=78941
Modified: trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp (108310 => 108311)
--- trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2012-02-21 07:07:21 UTC (rev 108310)
+++ trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2012-02-21 07:32:52 UTC (rev 108311)
@@ -586,10 +586,8 @@
notImplemented(); // Acknowledge self-closing flag
processFakeStartTag(formTag);
RefPtr<Attribute> actionAttribute = token.getAttributeItem(actionAttr);
- if (actionAttribute) {
- ASSERT(m_tree.currentElement()->hasTagName(formTag));
- m_tree.currentElement()->setAttribute(actionAttr, actionAttribute->value());
- }
+ if (actionAttribute)
+ m_tree.form()->setAttribute(actionAttr, actionAttribute->value());
processFakeStartTag(hrTag);
processFakeStartTag(labelTag);
RefPtr<Attribute> promptAttribute = token.getAttributeItem(promptAttr);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
