Title: [215914] trunk
Revision
215914
Author
cdu...@apple.com
Date
2017-04-27 18:53:56 -0700 (Thu, 27 Apr 2017)

Log Message

Align colspan/rowspan limits with the latest HTML specification
https://bugs.webkit.org/show_bug.cgi?id=171322

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Re-sync some web-platform-tests from upstream to gain test coverage and
rebaseline.

* resources/import-expectations.json:
* web-platform-tests/html/dom/elements-tabular.js:
* web-platform-tests/html/dom/reflection-embedded-expected.txt:
* web-platform-tests/html/dom/reflection-tabular-expected.txt:
* web-platform-tests/html/dom/reflection.js:
(ReflectionTests.typeMap.string_appeared_here.toString):
(ReflectionTests.typeMap.string_appeared_here.valueOf):
(ReflectionTests.reflects):
* web-platform-tests/html/semantics/tabular-data/attributes-common-to-td-and-th-elements/w3c-import.log:
* web-platform-tests/html/semantics/tabular-data/processing-model-1/span-limits-expected.txt: Added.
* web-platform-tests/html/semantics/tabular-data/processing-model-1/span-limits.html: Added.
* web-platform-tests/html/semantics/tabular-data/processing-model-1/w3c-import.log:
* web-platform-tests/html/semantics/tabular-data/the-caption-element/w3c-import.log:
* web-platform-tests/html/semantics/tabular-data/the-table-element/w3c-import.log:
* web-platform-tests/html/semantics/tabular-data/the-tbody-element/w3c-import.log:
* web-platform-tests/html/semantics/tabular-data/the-tfoot-element/w3c-import.log:
* web-platform-tests/html/semantics/tabular-data/the-thead-element/w3c-import.log:
* web-platform-tests/html/semantics/tabular-data/the-tr-element/w3c-import.log:
* web-platform-tests/html/semantics/tabular-data/w3c-import.log:

Source/WebCore:

Align colspan/rowspan limits with the latest HTML specification after:
- https://github.com/whatwg/html/pull/1993

The following changes were made:
- Our rowspan limit was raised from 8190 to 65534
- A colspan limit of 1000 was introduced. Blink has UseCounter data showing that
  colspans over 1000 are extremely rare and Gecko has data showing that when we
  get a colspan greater than 1000, it is usually a bug. Therefore, this change
  should be fine.
- The limits are now properly reflected via the IDL attributes instead of lying
  to the Web about the colspan / rowspan we are using internally.

Test: imported/w3c/web-platform-tests/html/semantics/tabular-data/processing-model-1/span-limits.html

* html/HTMLTableCellElement.cpp:
(WebCore::HTMLTableCellElement::colSpan):
(WebCore::HTMLTableCellElement::rowSpan):
(WebCore::HTMLTableCellElement::rowSpanForBindings):
(WebCore::HTMLTableCellElement::setColSpan):
* html/HTMLTableCellElement.h:
* html/HTMLTableCellElement.idl:
* html/parser/HTMLParserIdioms.cpp:
(WebCore::parseHTMLIntegerInternal):
(WebCore::parseHTMLInteger):
(WebCore::parseHTMLNonNegativeInteger):
(WebCore::parseValidHTMLNonNegativeIntegerInternal):
(WebCore::parseHTTPRefreshInternal):
* html/parser/HTMLParserIdioms.h:
(WebCore::parseHTMLInteger):
(WebCore::parseHTMLNonNegativeInteger):

(WebCore::clampHTMLNonNegativeIntegerToRange):
Add utility function to implement:
- https://html.spec.whatwg.org/#clamped-to-the-range

Source/WebKit/mac:

ObjC bindings build fix.

* DOM/DOMHTMLTableCellElement.mm:
(-[DOMHTMLTableCellElement colSpan]):
(-[DOMHTMLTableCellElement setColSpan:]):

Source/WebKit2:

GTK build fix.

* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableCellElement.cpp:
(webkit_dom_html_table_cell_element_get_col_span):
(webkit_dom_html_table_cell_element_set_col_span):

LayoutTests:

Rebaseline a couple of rowspan tests now that our max limit has changed.

* fast/table/giantRowspan2-expected.txt:
* platform/ios/fast/table/giantRowspan-expected.txt:
* platform/ios/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt:
* platform/mac/fast/table/giantRowspan-expected.txt:

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (215913 => 215914)


--- trunk/LayoutTests/ChangeLog	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/ChangeLog	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,3 +1,17 @@
+2017-04-27  Chris Dumez  <cdu...@apple.com>
+
+        Align colspan/rowspan limits with the latest HTML specification
+        https://bugs.webkit.org/show_bug.cgi?id=171322
+
+        Reviewed by Darin Adler.
+
+        Rebaseline a couple of rowspan tests now that our max limit has changed.
+
+        * fast/table/giantRowspan2-expected.txt:
+        * platform/ios/fast/table/giantRowspan-expected.txt:
+        * platform/ios/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt:
+        * platform/mac/fast/table/giantRowspan-expected.txt:
+
 2017-04-27  Matt Lewis  <jlew...@apple.com>
 
         Mark fast/mediacapturefromelement/CanvasCaptureMediaStream-2d-events.html as a flaky failure.

Modified: trunk/LayoutTests/fast/table/giantRowspan2-expected.txt (215913 => 215914)


--- trunk/LayoutTests/fast/table/giantRowspan2-expected.txt	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/fast/table/giantRowspan2-expected.txt	2017-04-28 01:53:56 UTC (rev 215914)
@@ -6,7 +6,7 @@
       RenderTable {TABLE} at (0,0) size 784x78
         RenderTableSection {TBODY} at (0,0) size 784x78
           RenderTableRow {TR} at (0,2) size 784x74
-            RenderTableCell {TD} at (2,2) size 780x74 [r=0 c=0 rs=8190 cs=1]
+            RenderTableCell {TD} at (2,2) size 780x74 [r=0 c=0 rs=65534 cs=1]
               RenderText {#text} at (1,1) size 771x72
                 text run at (1,1) width 687: "This test succeeds if it does not crash. We implemented a heuristic a while back to prevent giant rowspans. "
                 text run at (687,1) width 85: "The heuristic"

Modified: trunk/LayoutTests/imported/w3c/ChangeLog (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/ChangeLog	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/ChangeLog	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,5 +1,35 @@
 2017-04-27  Chris Dumez  <cdu...@apple.com>
 
+        Align colspan/rowspan limits with the latest HTML specification
+        https://bugs.webkit.org/show_bug.cgi?id=171322
+
+        Reviewed by Darin Adler.
+
+        Re-sync some web-platform-tests from upstream to gain test coverage and
+        rebaseline.
+
+        * resources/import-expectations.json:
+        * web-platform-tests/html/dom/elements-tabular.js:
+        * web-platform-tests/html/dom/reflection-embedded-expected.txt:
+        * web-platform-tests/html/dom/reflection-tabular-expected.txt:
+        * web-platform-tests/html/dom/reflection.js:
+        (ReflectionTests.typeMap.string_appeared_here.toString):
+        (ReflectionTests.typeMap.string_appeared_here.valueOf):
+        (ReflectionTests.reflects):
+        * web-platform-tests/html/semantics/tabular-data/attributes-common-to-td-and-th-elements/w3c-import.log:
+        * web-platform-tests/html/semantics/tabular-data/processing-model-1/span-limits-expected.txt: Added.
+        * web-platform-tests/html/semantics/tabular-data/processing-model-1/span-limits.html: Added.
+        * web-platform-tests/html/semantics/tabular-data/processing-model-1/w3c-import.log:
+        * web-platform-tests/html/semantics/tabular-data/the-caption-element/w3c-import.log:
+        * web-platform-tests/html/semantics/tabular-data/the-table-element/w3c-import.log:
+        * web-platform-tests/html/semantics/tabular-data/the-tbody-element/w3c-import.log:
+        * web-platform-tests/html/semantics/tabular-data/the-tfoot-element/w3c-import.log:
+        * web-platform-tests/html/semantics/tabular-data/the-thead-element/w3c-import.log:
+        * web-platform-tests/html/semantics/tabular-data/the-tr-element/w3c-import.log:
+        * web-platform-tests/html/semantics/tabular-data/w3c-import.log:
+
+2017-04-27  Chris Dumez  <cdu...@apple.com>
+
         Element.getBoundingClientRect() / getClientRects() should return a DOMRect types
         https://bugs.webkit.org/show_bug.cgi?id=171226
 

Modified: trunk/LayoutTests/imported/w3c/resources/import-expectations.json (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/resources/import-expectations.json	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/resources/import-expectations.json	2017-04-28 01:53:56 UTC (rev 215914)
@@ -189,6 +189,7 @@
     "web-platform-tests/html/semantics/scripting-1/the-script-element/module": "skip", 
     "web-platform-tests/html/semantics/scripting-1/the-script-element/script-for-event.xhtml": "skip", 
     "web-platform-tests/html/semantics/scripting-1/the-script-element/script-text.xhtml": "skip", 
+    "web-platform-tests/html/semantics/tabular-data": "import", 
     "web-platform-tests/html/semantics/text-level-semantics/the-data-element": "skip", 
     "web-platform-tests/html/syntax": "import", 
     "web-platform-tests/html/the-xhtml-syntax": "skip", 

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/elements-tabular.js (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/elements-tabular.js	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/elements-tabular.js	2017-04-28 01:53:56 UTC (rev 215914)
@@ -68,8 +68,8 @@
   },
   td: {
     // HTMLTableCellElement (Conforming)
-    colSpan: {type: "unsigned long", defaultVal: 1},
-    rowSpan: {type: "unsigned long", defaultVal: 1},
+    colSpan: {type: "clamped unsigned long", defaultVal: 1, min: 1, max: 1000},
+    rowSpan: {type: "clamped unsigned long", defaultVal: 1, min: 0, max: 65534},
     headers: "settable tokenlist",
     scope: {type: "enum", keywords: ["row", "col", "rowgroup", "colgroup"]},
     abbr: "string",
@@ -87,8 +87,8 @@
   },
   th: {
     // HTMLTableCellElement (Conforming)
-    colSpan: {type: "unsigned long", defaultVal: 1},
-    rowSpan: {type: "unsigned long", defaultVal: 1},
+    colSpan: {type: "clamped unsigned long", defaultVal: 1, min: 1, max: 1000},
+    rowSpan: {type: "clamped unsigned long", defaultVal: 1, min: 0, max: 65534},
     headers: "settable tokenlist",
     scope: {type: "enum", keywords: ["row", "col", "rowgroup", "colgroup"]},
     abbr: "string",

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt	2017-04-28 01:53:56 UTC (rev 215914)
@@ -6,19 +6,19 @@
 Blocked access to external URL http://site.example/path???@#l
 Blocked access to external URL http://site.example/
 Blocked access to external URL http://site.example/path???@#l
-CONSOLE MESSAGE: line 707: The language contains a null character and is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'undefined' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language '7' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language '1.5' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'true' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'false' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language '[object Object]' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'Infinity' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language '-Infinity' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language contains a null character and is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'null' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'test-toString' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'test-valueOf' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language contains a null character and is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'undefined' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language '7' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language '1.5' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'true' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'false' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language '[object Object]' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'Infinity' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language '-Infinity' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language contains a null character and is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'null' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'test-toString' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'test-valueOf' is not a valid BCP 47 language tag.
 CONSOLE MESSAGE: line 1406: The language contains a null character and is not a valid BCP 47 language tag.
 CONSOLE MESSAGE: line 1406: The language 'undefined' is not a valid BCP 47 language tag.
 CONSOLE MESSAGE: line 1406: The language '7' is not a valid BCP 47 language tag.

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/reflection-tabular-expected.txt (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/reflection-tabular-expected.txt	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/reflection-tabular-expected.txt	2017-04-28 01:53:56 UTC (rev 215914)
@@ -3534,7 +3534,6 @@
 PASS td.colSpan: setAttribute() to -1 
 PASS td.colSpan: setAttribute() to 0 
 PASS td.colSpan: setAttribute() to 1 
-PASS td.colSpan: setAttribute() to 257 
 PASS td.colSpan: setAttribute() to 2147483647 
 PASS td.colSpan: setAttribute() to 2147483648 
 PASS td.colSpan: setAttribute() to 4294967295 
@@ -3581,6 +3580,8 @@
 PASS td.colSpan: setAttribute() to "\0" 
 PASS td.colSpan: setAttribute() to object "2" 
 PASS td.colSpan: setAttribute() to object "3" 
+PASS td.colSpan: setAttribute() to 1000 
+PASS td.colSpan: setAttribute() to 1001 
 PASS td.colSpan: IDL set to 0 
 PASS td.colSpan: IDL set to 1 
 PASS td.colSpan: IDL set to 257 
@@ -3588,6 +3589,8 @@
 PASS td.colSpan: IDL set to "-0" 
 PASS td.colSpan: IDL set to 2147483648 
 PASS td.colSpan: IDL set to 4294967295 
+PASS td.colSpan: IDL set to 1000 
+PASS td.colSpan: IDL set to 1001 
 PASS td.rowSpan: typeof IDL attribute 
 PASS td.rowSpan: IDL get with DOM attribute unset 
 PASS td.rowSpan: setAttribute() to -2147483649 
@@ -3596,7 +3599,6 @@
 PASS td.rowSpan: setAttribute() to -1 
 PASS td.rowSpan: setAttribute() to 0 
 PASS td.rowSpan: setAttribute() to 1 
-PASS td.rowSpan: setAttribute() to 257 
 PASS td.rowSpan: setAttribute() to 2147483647 
 PASS td.rowSpan: setAttribute() to 2147483648 
 PASS td.rowSpan: setAttribute() to 4294967295 
@@ -3643,6 +3645,8 @@
 PASS td.rowSpan: setAttribute() to "\0" 
 PASS td.rowSpan: setAttribute() to object "2" 
 PASS td.rowSpan: setAttribute() to object "3" 
+PASS td.rowSpan: setAttribute() to 65534 
+PASS td.rowSpan: setAttribute() to 65535 
 PASS td.rowSpan: IDL set to 0 
 PASS td.rowSpan: IDL set to 1 
 PASS td.rowSpan: IDL set to 257 
@@ -3650,6 +3654,8 @@
 PASS td.rowSpan: IDL set to "-0" 
 PASS td.rowSpan: IDL set to 2147483648 
 PASS td.rowSpan: IDL set to 4294967295 
+PASS td.rowSpan: IDL set to 65534 
+PASS td.rowSpan: IDL set to 65535 
 PASS td.scope: typeof IDL attribute 
 PASS td.scope: IDL get with DOM attribute unset 
 PASS td.scope: setAttribute() to "" 
@@ -4298,7 +4304,6 @@
 PASS th.colSpan: setAttribute() to -1 
 PASS th.colSpan: setAttribute() to 0 
 PASS th.colSpan: setAttribute() to 1 
-PASS th.colSpan: setAttribute() to 257 
 PASS th.colSpan: setAttribute() to 2147483647 
 PASS th.colSpan: setAttribute() to 2147483648 
 PASS th.colSpan: setAttribute() to 4294967295 
@@ -4345,6 +4350,8 @@
 PASS th.colSpan: setAttribute() to "\0" 
 PASS th.colSpan: setAttribute() to object "2" 
 PASS th.colSpan: setAttribute() to object "3" 
+PASS th.colSpan: setAttribute() to 1000 
+PASS th.colSpan: setAttribute() to 1001 
 PASS th.colSpan: IDL set to 0 
 PASS th.colSpan: IDL set to 1 
 PASS th.colSpan: IDL set to 257 
@@ -4352,6 +4359,8 @@
 PASS th.colSpan: IDL set to "-0" 
 PASS th.colSpan: IDL set to 2147483648 
 PASS th.colSpan: IDL set to 4294967295 
+PASS th.colSpan: IDL set to 1000 
+PASS th.colSpan: IDL set to 1001 
 PASS th.rowSpan: typeof IDL attribute 
 PASS th.rowSpan: IDL get with DOM attribute unset 
 PASS th.rowSpan: setAttribute() to -2147483649 
@@ -4360,7 +4369,6 @@
 PASS th.rowSpan: setAttribute() to -1 
 PASS th.rowSpan: setAttribute() to 0 
 PASS th.rowSpan: setAttribute() to 1 
-PASS th.rowSpan: setAttribute() to 257 
 PASS th.rowSpan: setAttribute() to 2147483647 
 PASS th.rowSpan: setAttribute() to 2147483648 
 PASS th.rowSpan: setAttribute() to 4294967295 
@@ -4407,6 +4415,8 @@
 PASS th.rowSpan: setAttribute() to "\0" 
 PASS th.rowSpan: setAttribute() to object "2" 
 PASS th.rowSpan: setAttribute() to object "3" 
+PASS th.rowSpan: setAttribute() to 65534 
+PASS th.rowSpan: setAttribute() to 65535 
 PASS th.rowSpan: IDL set to 0 
 PASS th.rowSpan: IDL set to 1 
 PASS th.rowSpan: IDL set to 257 
@@ -4414,6 +4424,8 @@
 PASS th.rowSpan: IDL set to "-0" 
 PASS th.rowSpan: IDL set to 2147483648 
 PASS th.rowSpan: IDL set to 4294967295 
+PASS th.rowSpan: IDL set to 65534 
+PASS th.rowSpan: IDL set to 65535 
 PASS th.scope: typeof IDL attribute 
 PASS th.scope: IDL get with DOM attribute unset 
 PASS th.scope: setAttribute() to "" 

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/reflection.js (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/reflection.js	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/reflection.js	2017-04-28 01:53:56 UTC (rev 215914)
@@ -455,6 +455,37 @@
             "idlDomExpected": [null, 1, maxInt, null, null]
     },
     /**
+     * "If a reflecting IDL attribute has an unsigned integer type (unsigned
+     * long) that is clamped to the range [min, max], then on getting, the
+     * content attribute must first be parsed according to the rules for
+     * parsing non-negative integers, and if that is successful, and the value
+     * is between min and max inclusive, the resulting value must be returned.
+     * If it fails, the default value must be returned. If it succeeds but the
+     * value is less than min, min must be returned. If it succeeds but the
+     * value is greater than max, max must be returned. On setting, it behaves
+     * the same as a regular reflected unsigned integer."
+     *
+     * The data object passed to reflects must contain the keys defaultVal,
+     * min, and max.  As with enum, domExpected is generated later once we have
+     * access to the min and max.
+     */
+    "clamped unsigned long": {
+        "jsType": "number",
+        "domTests": [minInt - 1, minInt, -36,  -1,   0,    1, maxInt,
+                     maxInt + 1, maxUnsigned, maxUnsigned + 1, "", "-1", "-0", "0", "1",
+                     "\u00097", "\u000B7", "\u000C7", "\u00207", "\u00A07", "\uFEFF7",
+                     "\u000A7", "\u000D7", "\u20287", "\u20297", "\u16807", "\u180E7",
+                     "\u20007", "\u20017", "\u20027", "\u20037", "\u20047", "\u20057",
+                     "\u20067", "\u20077", "\u20087", "\u20097", "\u200A7", "\u202F7",
+                     "\u30007",
+                     " " + binaryString + " foo ", undefined, 1.5, true, false,
+                     {"test": 6}, NaN, +Infinity, -Infinity, "\0",
+                     {toString:function() {return 2;}, valueOf: null},
+                     {valueOf:function() {return 3;}}],
+        "idlTests": [0, 1, 257, maxInt, "-0", maxInt + 1, maxUnsigned],
+        "idlDomExpected": [0, 1, 257, maxInt, 0, null, null],
+    },
+    /**
      * "If a reflecting IDL attribute is a floating point number type (double),
      * then, on getting, the content attribute must be parsed according to the
      * rules for parsing floating point number values, and if that is
@@ -681,6 +712,54 @@
             }
         }
         break;
+
+        case "clamped unsigned long":
+        [data.min - 1, data.min, data.max, data.max + 1].forEach(function(val) {
+          if (domTests.indexOf(val) == -1) {
+            domTests.push(val);
+          }
+          if (idlTests.indexOf(val) == -1 && 0 <= val && val <= maxUnsigned) {
+            idlTests.push(val);
+            if (typeof val != "number") {
+              val = ReflectionTests.parseNonneg(val);
+            }
+            idlDomExpected.push(val > maxInt ? null : val);
+          }
+        });
+
+        // Rewrite expected values
+        domExpected = domTests.map(function(val) {
+            var parsed = ReflectionTests.parseNonneg(String(val));
+            if (parsed === false) {
+                return defaultVal;
+            }
+            if (parsed < data.min) {
+              return data.min;
+            }
+            if (parsed > data.max) {
+              return data.max;
+            }
+            return parsed;
+        });
+        idlIdlExpected = idlTests.map(function(val) {
+            if (typeof val != "number") {
+              val = ReflectionTests.parseNonneg(val);
+            }
+            if (val < 0 || val > maxUnsigned) {
+              throw "Test bug: val should be an unsigned long";
+            }
+            if (val > maxInt) {
+              return defaultVal;
+            }
+            if (val < data.min) {
+              return data.min;
+            }
+            if (val > data.max) {
+              return data.max;
+            }
+            return val;
+        });
+        break;
     }
     if (domObj.tagName.toLowerCase() == "canvas" && (domName == "width" || domName == "height")) {
         // Opera tries to allocate a canvas with the given width and height, so

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/attributes-common-to-td-and-th-elements/w3c-import.log (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/attributes-common-to-td-and-th-elements/w3c-import.log	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/attributes-common-to-td-and-th-elements/w3c-import.log	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,7 +1,6 @@
 The tests in this directory were imported from the W3C repository.
 Do NOT modify these tests directly in WebKit.
-Instead, create a pull request on the W3C CSS or WPT github:
-	https://github.com/w3c/csswg-test
+Instead, create a pull request on the WPT github:
 	https://github.com/w3c/web-platform-tests
 
 Then run the Tools/Scripts/import-w3c-tests in WebKit to reimport

Added: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/processing-model-1/span-limits-expected.txt (0 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/processing-model-1/span-limits-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/processing-model-1/span-limits-expected.txt	2017-04-28 01:53:56 UTC (rev 215914)
@@ -0,0 +1,12 @@
+
+PASS colspan of 1000 must work 
+PASS colspan of 1001 must be treated as 1000 
+PASS rowspan of 65534 must work 
+PASS rowspan of 65535 must be treated as 65534 
+a	a
+a
+a	a
+a
+a	
+a	
+a	

Added: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/processing-model-1/span-limits.html (0 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/processing-model-1/span-limits.html	                        (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/processing-model-1/span-limits.html	2017-04-28 01:53:56 UTC (rev 215914)
@@ -0,0 +1,65 @@
+<!DOCTYPE html>
+<title>Limits on colSpan/rowSpan</title>
+<script src=""
+<script src=""
+<div id=log></div>
+
+<table border=1>
+  <tr><td colspan=500>a<td colspan=500 id=a1>a
+  <!--  This cell must span the previous two  -->
+  <tr><td colspan=1000 id=a2>a
+</table>
+
+<table border=1>
+  <tr><td colspan=1000 id=b1>a<td>a
+  <!--  This cell must span only the first cell in the previous row  -->
+  <tr><td colspan=1001 id=b2>a
+</table>
+
+<table border=1 style="float:left">
+  <!--  The first column must go all the way down to the bottom  -->
+  <tr><td rowspan=65534 id=c1>a<td>
+  <!--  We'll add another 65533 rows later  -->
+</table>
+
+<table border=1>
+  <!--  The first column must go one cell below the bottom  -->
+  <tr><td rowspan=65535 id=d1>a<td>
+  <!--  We'll add another 65534 rows later  -->
+</table>
+
+<script>
+var $ = document.querySelector.bind(document);
+
+test(() => {
+    assert_equals($("#a2").getBoundingClientRect().right,
+                  $("#a1").getBoundingClientRect().right);
+}, "colspan of 1000 must work");
+
+test(() => {
+    assert_equals($("#b2").getBoundingClientRect().right,
+                  $("#b1").getBoundingClientRect().right);
+}, "colspan of 1001 must be treated as 1000");
+
+test(() => {
+    var s = "";
+    for (var i = 0; i < 65532; i++) {
+      s += "<tr><td>";
+    }
+    s += "<tr><td id=c2>";
+    document.querySelectorAll("table")[2].firstElementChild.innerHTML += s;
+    assert_equals($("#c1").getBoundingClientRect().bottom,
+                  $("#c2").getBoundingClientRect().bottom);
+}, "rowspan of 65534 must work");
+
+test(() => {
+    var s = "";
+    for (var i = 0; i < 65532; i++) {
+      s += "<tr><td>";
+    }
+    s += "<tr><td id=d2><tr><td>a<td>";
+    document.querySelectorAll("table")[3].firstElementChild.innerHTML += s;
+    assert_equals($("#d1").getBoundingClientRect().bottom,
+                  $("#d2").getBoundingClientRect().bottom);
+}, "rowspan of 65535 must be treated as 65534");
+</script>

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/processing-model-1/w3c-import.log (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/processing-model-1/w3c-import.log	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/processing-model-1/w3c-import.log	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,7 +1,6 @@
 The tests in this directory were imported from the W3C repository.
 Do NOT modify these tests directly in WebKit.
-Instead, create a pull request on the W3C CSS or WPT github:
-	https://github.com/w3c/csswg-test
+Instead, create a pull request on the WPT github:
 	https://github.com/w3c/web-platform-tests
 
 Then run the Tools/Scripts/import-w3c-tests in WebKit to reimport
@@ -16,3 +15,4 @@
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/processing-model-1/contains.json
+/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/processing-model-1/span-limits.html

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-caption-element/w3c-import.log (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-caption-element/w3c-import.log	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-caption-element/w3c-import.log	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,7 +1,6 @@
 The tests in this directory were imported from the W3C repository.
 Do NOT modify these tests directly in WebKit.
-Instead, create a pull request on the W3C CSS or WPT github:
-	https://github.com/w3c/csswg-test
+Instead, create a pull request on the WPT github:
 	https://github.com/w3c/web-platform-tests
 
 Then run the Tools/Scripts/import-w3c-tests in WebKit to reimport

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-table-element/w3c-import.log (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-table-element/w3c-import.log	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-table-element/w3c-import.log	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,7 +1,6 @@
 The tests in this directory were imported from the W3C repository.
 Do NOT modify these tests directly in WebKit.
-Instead, create a pull request on the W3C CSS or WPT github:
-	https://github.com/w3c/csswg-test
+Instead, create a pull request on the WPT github:
 	https://github.com/w3c/web-platform-tests
 
 Then run the Tools/Scripts/import-w3c-tests in WebKit to reimport

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-tbody-element/w3c-import.log (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-tbody-element/w3c-import.log	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-tbody-element/w3c-import.log	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,7 +1,6 @@
 The tests in this directory were imported from the W3C repository.
 Do NOT modify these tests directly in WebKit.
-Instead, create a pull request on the W3C CSS or WPT github:
-	https://github.com/w3c/csswg-test
+Instead, create a pull request on the WPT github:
 	https://github.com/w3c/web-platform-tests
 
 Then run the Tools/Scripts/import-w3c-tests in WebKit to reimport

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-tfoot-element/w3c-import.log (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-tfoot-element/w3c-import.log	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-tfoot-element/w3c-import.log	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,7 +1,6 @@
 The tests in this directory were imported from the W3C repository.
 Do NOT modify these tests directly in WebKit.
-Instead, create a pull request on the W3C CSS or WPT github:
-	https://github.com/w3c/csswg-test
+Instead, create a pull request on the WPT github:
 	https://github.com/w3c/web-platform-tests
 
 Then run the Tools/Scripts/import-w3c-tests in WebKit to reimport

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-thead-element/w3c-import.log (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-thead-element/w3c-import.log	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-thead-element/w3c-import.log	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,7 +1,6 @@
 The tests in this directory were imported from the W3C repository.
 Do NOT modify these tests directly in WebKit.
-Instead, create a pull request on the W3C CSS or WPT github:
-	https://github.com/w3c/csswg-test
+Instead, create a pull request on the WPT github:
 	https://github.com/w3c/web-platform-tests
 
 Then run the Tools/Scripts/import-w3c-tests in WebKit to reimport

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-tr-element/w3c-import.log (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-tr-element/w3c-import.log	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/the-tr-element/w3c-import.log	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,7 +1,6 @@
 The tests in this directory were imported from the W3C repository.
 Do NOT modify these tests directly in WebKit.
-Instead, create a pull request on the W3C CSS or WPT github:
-	https://github.com/w3c/csswg-test
+Instead, create a pull request on the WPT github:
 	https://github.com/w3c/web-platform-tests
 
 Then run the Tools/Scripts/import-w3c-tests in WebKit to reimport

Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/w3c-import.log (215913 => 215914)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/w3c-import.log	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/tabular-data/w3c-import.log	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,7 +1,6 @@
 The tests in this directory were imported from the W3C repository.
 Do NOT modify these tests directly in WebKit.
-Instead, create a pull request on the W3C CSS or WPT github:
-	https://github.com/w3c/csswg-test
+Instead, create a pull request on the WPT github:
 	https://github.com/w3c/web-platform-tests
 
 Then run the Tools/Scripts/import-w3c-tests in WebKit to reimport

Modified: trunk/LayoutTests/platform/ios/fast/table/giantRowspan-expected.txt (215913 => 215914)


--- trunk/LayoutTests/platform/ios/fast/table/giantRowspan-expected.txt	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/platform/ios/fast/table/giantRowspan-expected.txt	2017-04-28 01:53:56 UTC (rev 215914)
@@ -7,4 +7,4 @@
       RenderTable {TABLE} at (0,10) size 6x6
         RenderTableSection {TBODY} at (0,0) size 6x6
           RenderTableRow {TR} at (0,2) size 6x2
-            RenderTableCell {TD} at (2,2) size 2x2 [r=0 c=0 rs=8190 cs=1]
+            RenderTableCell {TD} at (2,2) size 2x2 [r=0 c=0 rs=65534 cs=1]

Modified: trunk/LayoutTests/platform/ios/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt (215913 => 215914)


--- trunk/LayoutTests/platform/ios/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/platform/ios/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt	2017-04-28 01:53:56 UTC (rev 215914)
@@ -6,19 +6,19 @@
 Blocked access to external URL http://site.example/path???@#l
 Blocked access to external URL http://site.example/
 Blocked access to external URL http://site.example/path???@#l
-CONSOLE MESSAGE: line 707: The language contains a null character and is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'undefined' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language '7' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language '1.5' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'true' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'false' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language '[object Object]' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'Infinity' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language '-Infinity' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language contains a null character and is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'null' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'test-toString' is not a valid BCP 47 language tag.
-CONSOLE MESSAGE: line 707: The language 'test-valueOf' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language contains a null character and is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'undefined' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language '7' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language '1.5' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'true' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'false' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language '[object Object]' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'Infinity' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language '-Infinity' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language contains a null character and is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'null' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'test-toString' is not a valid BCP 47 language tag.
+CONSOLE MESSAGE: line 786: The language 'test-valueOf' is not a valid BCP 47 language tag.
 CONSOLE MESSAGE: line 1406: The language contains a null character and is not a valid BCP 47 language tag.
 CONSOLE MESSAGE: line 1406: The language 'undefined' is not a valid BCP 47 language tag.
 CONSOLE MESSAGE: line 1406: The language '7' is not a valid BCP 47 language tag.

Modified: trunk/LayoutTests/platform/mac/fast/table/giantRowspan-expected.txt (215913 => 215914)


--- trunk/LayoutTests/platform/mac/fast/table/giantRowspan-expected.txt	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/LayoutTests/platform/mac/fast/table/giantRowspan-expected.txt	2017-04-28 01:53:56 UTC (rev 215914)
@@ -7,4 +7,4 @@
       RenderTable {TABLE} at (0,10) size 6x6
         RenderTableSection {TBODY} at (0,0) size 6x6
           RenderTableRow {TR} at (0,2) size 6x2
-            RenderTableCell {TD} at (2,2) size 2x2 [r=0 c=0 rs=8190 cs=1]
+            RenderTableCell {TD} at (2,2) size 2x2 [r=0 c=0 rs=65534 cs=1]

Modified: trunk/Source/WebCore/ChangeLog (215913 => 215914)


--- trunk/Source/WebCore/ChangeLog	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/ChangeLog	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,3 +1,45 @@
+2017-04-27  Chris Dumez  <cdu...@apple.com>
+
+        Align colspan/rowspan limits with the latest HTML specification
+        https://bugs.webkit.org/show_bug.cgi?id=171322
+
+        Reviewed by Darin Adler.
+
+        Align colspan/rowspan limits with the latest HTML specification after:
+        - https://github.com/whatwg/html/pull/1993
+
+        The following changes were made:
+        - Our rowspan limit was raised from 8190 to 65534
+        - A colspan limit of 1000 was introduced. Blink has UseCounter data showing that
+          colspans over 1000 are extremely rare and Gecko has data showing that when we
+          get a colspan greater than 1000, it is usually a bug. Therefore, this change
+          should be fine.
+        - The limits are now properly reflected via the IDL attributes instead of lying
+          to the Web about the colspan / rowspan we are using internally.
+
+        Test: imported/w3c/web-platform-tests/html/semantics/tabular-data/processing-model-1/span-limits.html
+
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::colSpan):
+        (WebCore::HTMLTableCellElement::rowSpan):
+        (WebCore::HTMLTableCellElement::rowSpanForBindings):
+        (WebCore::HTMLTableCellElement::setColSpan):
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableCellElement.idl:
+        * html/parser/HTMLParserIdioms.cpp:
+        (WebCore::parseHTMLIntegerInternal):
+        (WebCore::parseHTMLInteger):
+        (WebCore::parseHTMLNonNegativeInteger):
+        (WebCore::parseValidHTMLNonNegativeIntegerInternal):
+        (WebCore::parseHTTPRefreshInternal):
+        * html/parser/HTMLParserIdioms.h:
+        (WebCore::parseHTMLInteger):
+        (WebCore::parseHTMLNonNegativeInteger):
+
+        (WebCore::clampHTMLNonNegativeIntegerToRange):
+        Add utility function to implement:
+        - https://html.spec.whatwg.org/#clamped-to-the-range
+
 2017-04-27  Wenson Hsieh  <wenson_hs...@apple.com>
 
         WKUIDelegatePrivate needs a hook to vend data used to initialize item providers for data interaction

Modified: trunk/Source/WebCore/dom/Element.cpp (215913 => 215914)


--- trunk/Source/WebCore/dom/Element.cpp	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/dom/Element.cpp	2017-04-28 01:53:56 UTC (rev 215914)
@@ -3048,7 +3048,7 @@
 
 int Element::getIntegralAttribute(const QualifiedName& attributeName) const
 {
-    return parseHTMLInteger(getAttribute(attributeName)).value_or(0);
+    return parseHTMLInteger(getAttribute(attributeName)).valueOr(0);
 }
 
 void Element::setIntegralAttribute(const QualifiedName& attributeName, int value)
@@ -3058,7 +3058,7 @@
 
 unsigned Element::getUnsignedIntegralAttribute(const QualifiedName& attributeName) const
 {
-    return parseHTMLNonNegativeInteger(getAttribute(attributeName)).value_or(0);
+    return parseHTMLNonNegativeInteger(getAttribute(attributeName)).valueOr(0);
 }
 
 void Element::setUnsignedIntegralAttribute(const QualifiedName& attributeName, unsigned value)

Modified: trunk/Source/WebCore/html/HTMLElement.cpp (215913 => 215914)


--- trunk/Source/WebCore/html/HTMLElement.cpp	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/html/HTMLElement.cpp	2017-04-28 01:53:56 UTC (rev 215914)
@@ -101,8 +101,8 @@
 
 unsigned HTMLElement::parseBorderWidthAttribute(const AtomicString& value) const
 {
-    if (std::optional<unsigned> borderWidth = parseHTMLNonNegativeInteger(value))
-        return borderWidth.value();
+    if (auto optionalBorderWidth = parseHTMLNonNegativeInteger(value))
+        return optionalBorderWidth.value();
 
     return hasTagName(tableTag) ? 1 : 0;
 }
@@ -424,8 +424,8 @@
     if (name == tabindexAttr) {
         if (value.isEmpty())
             clearTabIndexExplicitlyIfNeeded();
-        else if (std::optional<int> tabIndex = parseHTMLInteger(value))
-            setTabIndexExplicitly(tabIndex.value());
+        else if (auto optionalTabIndex = parseHTMLInteger(value))
+            setTabIndexExplicitly(optionalTabIndex.value());
         return;
     }
 

Modified: trunk/Source/WebCore/html/HTMLImageElement.cpp (215913 => 215914)


--- trunk/Source/WebCore/html/HTMLImageElement.cpp	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/html/HTMLImageElement.cpp	2017-04-28 01:53:56 UTC (rev 215914)
@@ -371,9 +371,9 @@
 {
     if (!renderer()) {
         // check the attribute first for an explicit pixel value
-        std::optional<unsigned> width = parseHTMLNonNegativeInteger(attributeWithoutSynchronization(widthAttr));
-        if (width)
-            return width.value();
+        auto optionalWidth = parseHTMLNonNegativeInteger(attributeWithoutSynchronization(widthAttr));
+        if (optionalWidth)
+            return optionalWidth.value();
 
         // if the image is available, use its width
         if (m_imageLoader.image())
@@ -396,9 +396,9 @@
 {
     if (!renderer()) {
         // check the attribute first for an explicit pixel value
-        std::optional<unsigned> height = parseHTMLNonNegativeInteger(attributeWithoutSynchronization(heightAttr));
-        if (height)
-            return height.value();
+        auto optionalHeight = parseHTMLNonNegativeInteger(attributeWithoutSynchronization(heightAttr));
+        if (optionalHeight)
+            return optionalHeight.value();
 
         // if the image is available, use its height
         if (m_imageLoader.image())

Modified: trunk/Source/WebCore/html/HTMLInputElement.cpp (215913 => 215914)


--- trunk/Source/WebCore/html/HTMLInputElement.cpp	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/html/HTMLInputElement.cpp	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1771,7 +1771,7 @@
 void HTMLInputElement::maxLengthAttributeChanged(const AtomicString& newValue)
 {
     unsigned oldEffectiveMaxLength = effectiveMaxLength();
-    internalSetMaxLength(parseHTMLNonNegativeInteger(newValue).value_or(-1));
+    internalSetMaxLength(parseHTMLNonNegativeInteger(newValue).valueOr(-1));
     if (oldEffectiveMaxLength != effectiveMaxLength())
         updateValueIfNeeded();
 
@@ -1783,7 +1783,7 @@
 void HTMLInputElement::minLengthAttributeChanged(const AtomicString& newValue)
 {
     int oldMinLength = minLength();
-    internalSetMinLength(parseHTMLNonNegativeInteger(newValue).value_or(-1));
+    internalSetMinLength(parseHTMLNonNegativeInteger(newValue).valueOr(-1));
     if (oldMinLength != minLength())
         updateValueIfNeeded();
 

Modified: trunk/Source/WebCore/html/HTMLOListElement.cpp (215913 => 215914)


--- trunk/Source/WebCore/html/HTMLOListElement.cpp	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/html/HTMLOListElement.cpp	2017-04-28 01:53:56 UTC (rev 215914)
@@ -80,7 +80,8 @@
 {
     if (name == startAttr) {
         int oldStart = start();
-        m_start = parseHTMLInteger(value);
+        auto optionalStart = parseHTMLInteger(value);
+        m_start = optionalStart ? std::optional<int>(optionalStart.value()) : std::nullopt;
         if (oldStart == start())
             return;
         updateItemValues();

Modified: trunk/Source/WebCore/html/HTMLTableCellElement.cpp (215913 => 215914)


--- trunk/Source/WebCore/html/HTMLTableCellElement.cpp	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/html/HTMLTableCellElement.cpp	2017-04-28 01:53:56 UTC (rev 215914)
@@ -36,6 +36,16 @@
 
 using namespace HTMLNames;
 
+// These limits are defined in the HTML specification:
+// - https://html.spec.whatwg.org/#dom-tdth-colspan
+// - https://html.spec.whatwg.org/#dom-tdth-rowspan
+static const unsigned minColspan = 1;
+static const unsigned maxColspan = 1000;
+static const unsigned defaultColspan = 1;
+static const unsigned minRowspan = 0;
+static const unsigned maxRowspan = 65534;
+static const unsigned defaultRowspan = 1;
+
 Ref<HTMLTableCellElement> HTMLTableCellElement::create(const QualifiedName& tagName, Document& document)
 {
     return adoptRef(*new HTMLTableCellElement(tagName, document));
@@ -49,24 +59,18 @@
 
 unsigned HTMLTableCellElement::colSpan() const
 {
-    return std::max(1u, colSpanForBindings());
+    return clampHTMLNonNegativeIntegerToRange(attributeWithoutSynchronization(colspanAttr), minColspan, maxColspan, defaultColspan);
 }
 
-unsigned HTMLTableCellElement::colSpanForBindings() const
-{
-    return limitToOnlyHTMLNonNegative(attributeWithoutSynchronization(colspanAttr), 1u);
-}
-
 unsigned HTMLTableCellElement::rowSpan() const
 {
-    static const unsigned maxRowspan = 8190;
     // FIXME: a rowSpan equal to 0 should be allowed, and mean that the cell is to span all the remaining rows in the row group.
-    return std::max(1u, std::min(rowSpanForBindings(), maxRowspan));
+    return std::max(1u, rowSpanForBindings());
 }
 
 unsigned HTMLTableCellElement::rowSpanForBindings() const
 {
-    return limitToOnlyHTMLNonNegative(attributeWithoutSynchronization(rowspanAttr), 1u);
+    return clampHTMLNonNegativeIntegerToRange(attributeWithoutSynchronization(rowspanAttr), minRowspan, maxRowspan, defaultRowspan);
 }
 
 int HTMLTableCellElement::cellIndex() const
@@ -144,7 +148,7 @@
     return attributeWithoutSynchronization(axisAttr);
 }
 
-void HTMLTableCellElement::setColSpanForBindings(unsigned n)
+void HTMLTableCellElement::setColSpan(unsigned n)
 {
     setAttributeWithoutSynchronization(colspanAttr, AtomicString::number(limitToOnlyHTMLNonNegative(n, 1)));
 }

Modified: trunk/Source/WebCore/html/HTMLTableCellElement.h (215913 => 215914)


--- trunk/Source/WebCore/html/HTMLTableCellElement.h	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/html/HTMLTableCellElement.h	2017-04-28 01:53:56 UTC (rev 215914)
@@ -34,13 +34,12 @@
     static Ref<HTMLTableCellElement> create(const QualifiedName&, Document&);
 
     WEBCORE_EXPORT int cellIndex() const;
-    unsigned colSpan() const;
-    WEBCORE_EXPORT unsigned colSpanForBindings() const;
+    WEBCORE_EXPORT unsigned colSpan() const;
     unsigned rowSpan() const;
     WEBCORE_EXPORT unsigned rowSpanForBindings() const;
 
     void setCellIndex(int);
-    WEBCORE_EXPORT void setColSpanForBindings(unsigned);
+    WEBCORE_EXPORT void setColSpan(unsigned);
     WEBCORE_EXPORT void setRowSpanForBindings(unsigned);
 
     String abbr() const;

Modified: trunk/Source/WebCore/html/HTMLTableCellElement.idl (215913 => 215914)


--- trunk/Source/WebCore/html/HTMLTableCellElement.idl	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/html/HTMLTableCellElement.idl	2017-04-28 01:53:56 UTC (rev 215914)
@@ -26,7 +26,7 @@
     [Reflect=char] attribute DOMString ch;
     [Reflect=charoff] attribute DOMString chOff;
 
-    [ImplementedAs=colSpanForBindings] attribute unsigned long colSpan;
+    attribute unsigned long colSpan;
     [ImplementedAs=rowSpanForBindings] attribute unsigned long rowSpan;
 
     [Reflect] attribute DOMString headers;

Modified: trunk/Source/WebCore/html/HTMLTextAreaElement.cpp (215913 => 215914)


--- trunk/Source/WebCore/html/HTMLTextAreaElement.cpp	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/html/HTMLTextAreaElement.cpp	2017-04-28 01:53:56 UTC (rev 215914)
@@ -202,13 +202,13 @@
 
 void HTMLTextAreaElement::maxLengthAttributeChanged(const AtomicString& newValue)
 {
-    internalSetMaxLength(parseHTMLNonNegativeInteger(newValue).value_or(-1));
+    internalSetMaxLength(parseHTMLNonNegativeInteger(newValue).valueOr(-1));
     updateValidity();
 }
 
 void HTMLTextAreaElement::minLengthAttributeChanged(const AtomicString& newValue)
 {
-    internalSetMinLength(parseHTMLNonNegativeInteger(newValue).value_or(-1));
+    internalSetMinLength(parseHTMLNonNegativeInteger(newValue).valueOr(-1));
     updateValidity();
 }
 

Modified: trunk/Source/WebCore/html/ImageInputType.cpp (215913 => 215914)


--- trunk/Source/WebCore/html/ImageInputType.cpp	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/html/ImageInputType.cpp	2017-04-28 01:53:56 UTC (rev 215914)
@@ -179,8 +179,8 @@
 
     if (!element->renderer()) {
         // Check the attribute first for an explicit pixel value.
-        if (std::optional<unsigned> height = parseHTMLNonNegativeInteger(element->attributeWithoutSynchronization(heightAttr)))
-            return height.value();
+        if (auto optionalHeight = parseHTMLNonNegativeInteger(element->attributeWithoutSynchronization(heightAttr)))
+            return optionalHeight.value();
 
         // If the image is available, use its height.
         HTMLImageLoader* imageLoader = element->imageLoader();
@@ -200,8 +200,8 @@
 
     if (!element->renderer()) {
         // Check the attribute first for an explicit pixel value.
-        if (std::optional<unsigned> width = parseHTMLNonNegativeInteger(element->attributeWithoutSynchronization(widthAttr)))
-            return width.value();
+        if (auto optionalWidth = parseHTMLNonNegativeInteger(element->attributeWithoutSynchronization(widthAttr)))
+            return optionalWidth.value();
 
         // If the image is available, use its width.
         HTMLImageLoader* imageLoader = element->imageLoader();

Modified: trunk/Source/WebCore/html/parser/HTMLParserIdioms.cpp (215913 => 215914)


--- trunk/Source/WebCore/html/parser/HTMLParserIdioms.cpp	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/html/parser/HTMLParserIdioms.cpp	2017-04-28 01:53:56 UTC (rev 215914)
@@ -154,13 +154,13 @@
 }
 
 template <typename CharacterType>
-static std::optional<int> parseHTMLIntegerInternal(const CharacterType* position, const CharacterType* end)
+static Expected<int, HTMLIntegerParsingError> parseHTMLIntegerInternal(const CharacterType* position, const CharacterType* end)
 {
     while (position < end && isHTMLSpace(*position))
         ++position;
 
     if (position == end)
-        return std::nullopt;
+        return makeUnexpected(HTMLIntegerParsingError::Other);
 
     bool isNegative = false;
     if (*position == '-') {
@@ -170,7 +170,7 @@
         ++position;
 
     if (position == end || !isASCIIDigit(*position))
-        return std::nullopt;
+        return makeUnexpected(HTMLIntegerParsingError::Other);
 
     constexpr int intMax = std::numeric_limits<int>::max();
     constexpr int base = 10;
@@ -181,7 +181,7 @@
         int digitValue = *position - '0';
 
         if (result > maxMultiplier || (result == maxMultiplier && digitValue > (intMax % base) + isNegative))
-            return std::nullopt;
+            return makeUnexpected(isNegative ? HTMLIntegerParsingError::NegativeOverflow : HTMLIntegerParsingError::PositiveOverflow);
 
         result = base * result + digitValue;
         ++position;
@@ -191,11 +191,11 @@
 }
 
 // https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-integers
-std::optional<int> parseHTMLInteger(StringView input)
+Expected<int, HTMLIntegerParsingError> parseHTMLInteger(StringView input)
 {
     unsigned length = input.length();
     if (!length)
-        return std::nullopt;
+        return makeUnexpected(HTMLIntegerParsingError::Other);
 
     if (LIKELY(input.is8Bit())) {
         auto* start = input.characters8();
@@ -207,13 +207,16 @@
 }
 
 // https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-non-negative-integers
-std::optional<unsigned> parseHTMLNonNegativeInteger(StringView input)
+Expected<unsigned, HTMLIntegerParsingError> parseHTMLNonNegativeInteger(StringView input)
 {
-    std::optional<int> signedValue = parseHTMLInteger(input);
-    if (!signedValue || signedValue.value() < 0)
-        return std::nullopt;
+    auto optionalSignedResult = parseHTMLInteger(input);
+    if (!optionalSignedResult)
+        return optionalSignedResult.getUnexpected();
 
-    return static_cast<unsigned>(signedValue.value());
+    if (optionalSignedResult.value() < 0)
+        return makeUnexpected(HTMLIntegerParsingError::NegativeOverflow);
+
+    return static_cast<unsigned>(optionalSignedResult.value());
 }
 
 template <typename CharacterType>
@@ -225,11 +228,11 @@
             return std::nullopt;
     }
 
-    std::optional<int> signedValue = parseHTMLIntegerInternal(position, end);
-    if (!signedValue || signedValue.value() < 0)
+    auto optionalSignedValue = parseHTMLIntegerInternal(position, end);
+    if (!optionalSignedValue || optionalSignedValue.value() < 0)
         return std::nullopt;
 
-    return signedValue;
+    return optionalSignedValue.value();
 }
 
 // https://html.spec.whatwg.org/#valid-non-negative-integer
@@ -363,8 +366,8 @@
     while (position < end && isASCIIDigit(*position))
         ++position;
 
-    std::optional<unsigned> number = parseHTMLNonNegativeInteger(StringView(numberStart, position - numberStart));
-    if (!number)
+    auto optionalNumber = parseHTMLNonNegativeInteger(StringView(numberStart, position - numberStart));
+    if (!optionalNumber)
         return false;
 
     while (position < end && (isASCIIDigit(*position) || *position == '.'))
@@ -371,7 +374,7 @@
         ++position;
 
     if (position == end) {
-        parsedDelay = number.value();
+        parsedDelay = optionalNumber.value();
         return true;
     }
 
@@ -378,7 +381,7 @@
     if (*position != ';' && *position != ',' && !isHTMLSpace(*position))
         return false;
 
-    parsedDelay = number.value();
+    parsedDelay = optionalNumber.value();
 
     while (position < end && isHTMLSpace(*position))
         ++position;

Modified: trunk/Source/WebCore/html/parser/HTMLParserIdioms.h (215913 => 215914)


--- trunk/Source/WebCore/html/parser/HTMLParserIdioms.h	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/html/parser/HTMLParserIdioms.h	2017-04-28 01:53:56 UTC (rev 215914)
@@ -25,6 +25,7 @@
 #pragma once
 
 #include <unicode/uchar.h>
+#include <wtf/Expected.h>
 #include <wtf/Forward.h>
 #include <wtf/Optional.h>
 #include <wtf/Vector.h>
@@ -62,10 +63,12 @@
 double parseToDoubleForNumberType(const String&, double fallbackValue);
 
 // http://www.whatwg.org/specs/web-apps/current-work/#rules-for-parsing-integers
-WEBCORE_EXPORT std::optional<int> parseHTMLInteger(StringView);
+enum class HTMLIntegerParsingError { NegativeOverflow, PositiveOverflow, Other };
 
+WEBCORE_EXPORT Expected<int, HTMLIntegerParsingError> parseHTMLInteger(StringView);
+
 // http://www.whatwg.org/specs/web-apps/current-work/#rules-for-parsing-non-negative-integers
-WEBCORE_EXPORT std::optional<unsigned> parseHTMLNonNegativeInteger(StringView);
+WEBCORE_EXPORT Expected<unsigned, HTMLIntegerParsingError> parseHTMLNonNegativeInteger(StringView);
 
 // https://html.spec.whatwg.org/#valid-non-negative-integer
 std::optional<int> parseValidHTMLNonNegativeInteger(StringView);
@@ -155,9 +158,21 @@
 inline unsigned limitToOnlyHTMLNonNegative(StringView stringValue, unsigned defaultValue = 0)
 {
     ASSERT(defaultValue <= maxHTMLNonNegativeInteger);
-    unsigned value = parseHTMLNonNegativeInteger(stringValue).value_or(defaultValue);
+    unsigned value = parseHTMLNonNegativeInteger(stringValue).valueOr(defaultValue);
     ASSERT(value <= maxHTMLNonNegativeInteger);
     return value;
 }
 
+// https://html.spec.whatwg.org/#clamped-to-the-range
+inline unsigned clampHTMLNonNegativeIntegerToRange(StringView stringValue, unsigned min, unsigned max, unsigned defaultValue = 0)
+{
+    ASSERT(defaultValue >= min);
+    ASSERT(defaultValue <= max);
+    auto optionalValue = parseHTMLNonNegativeInteger(stringValue);
+    if (optionalValue)
+        return std::min(std::max(optionalValue.value(), min), max);
+
+    return optionalValue.error() == HTMLIntegerParsingError::PositiveOverflow ? max : defaultValue;
+}
+
 } // namespace WebCore

Modified: trunk/Source/WebCore/svg/SVGElement.cpp (215913 => 215914)


--- trunk/Source/WebCore/svg/SVGElement.cpp	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebCore/svg/SVGElement.cpp	2017-04-28 01:53:56 UTC (rev 215914)
@@ -462,8 +462,8 @@
     if (name == HTMLNames::tabindexAttr) {
         if (value.isEmpty())
             clearTabIndexExplicitlyIfNeeded();
-        else if (std::optional<int> tabIndex = parseHTMLInteger(value))
-            setTabIndexExplicitly(tabIndex.value());
+        else if (auto optionalTabIndex = parseHTMLInteger(value))
+            setTabIndexExplicitly(optionalTabIndex.value());
         return;
     }
 

Modified: trunk/Source/WebKit/mac/ChangeLog (215913 => 215914)


--- trunk/Source/WebKit/mac/ChangeLog	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebKit/mac/ChangeLog	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,3 +1,16 @@
+2017-04-27  Chris Dumez  <cdu...@apple.com>
+
+        Align colspan/rowspan limits with the latest HTML specification
+        https://bugs.webkit.org/show_bug.cgi?id=171322
+
+        Reviewed by Darin Adler.
+
+        ObjC bindings build fix.
+
+        * DOM/DOMHTMLTableCellElement.mm:
+        (-[DOMHTMLTableCellElement colSpan]):
+        (-[DOMHTMLTableCellElement setColSpan:]):
+
 2017-04-27  Said Abou-Hallawa  <sabouhall...@apple.com>
 
         REGRESSION(r213764): Async decoding of animated images is disabled for ImageDocument

Modified: trunk/Source/WebKit/mac/DOM/DOMHTMLTableCellElement.mm (215913 => 215914)


--- trunk/Source/WebKit/mac/DOM/DOMHTMLTableCellElement.mm	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebKit/mac/DOM/DOMHTMLTableCellElement.mm	2017-04-28 01:53:56 UTC (rev 215914)
@@ -108,13 +108,13 @@
 - (int)colSpan
 {
     WebCore::JSMainThreadNullState state;
-    return IMPL->colSpanForBindings();
+    return IMPL->colSpan();
 }
 
 - (void)setColSpan:(int)newColSpan
 {
     WebCore::JSMainThreadNullState state;
-    IMPL->setColSpanForBindings(newColSpan);
+    IMPL->setColSpan(newColSpan);
 }
 
 - (int)rowSpan

Modified: trunk/Source/WebKit2/ChangeLog (215913 => 215914)


--- trunk/Source/WebKit2/ChangeLog	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebKit2/ChangeLog	2017-04-28 01:53:56 UTC (rev 215914)
@@ -1,3 +1,16 @@
+2017-04-27  Chris Dumez  <cdu...@apple.com>
+
+        Align colspan/rowspan limits with the latest HTML specification
+        https://bugs.webkit.org/show_bug.cgi?id=171322
+
+        Reviewed by Darin Adler.
+
+        GTK build fix.
+
+        * WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableCellElement.cpp:
+        (webkit_dom_html_table_cell_element_get_col_span):
+        (webkit_dom_html_table_cell_element_set_col_span):
+
 2017-04-27  Wenson Hsieh  <wenson_hs...@apple.com>
 
         WKUIDelegatePrivate needs a hook to vend data used to initialize item providers for data interaction

Modified: trunk/Source/WebKit2/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableCellElement.cpp (215913 => 215914)


--- trunk/Source/WebKit2/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableCellElement.cpp	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Source/WebKit2/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableCellElement.cpp	2017-04-28 01:53:56 UTC (rev 215914)
@@ -494,7 +494,7 @@
     WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(WEBKIT_DOM_IS_HTML_TABLE_CELL_ELEMENT(self), 0);
     WebCore::HTMLTableCellElement* item = WebKit::core(self);
-    glong result = item->colSpanForBindings();
+    glong result = item->colSpan();
     return result;
 }
 
@@ -503,7 +503,7 @@
     WebCore::JSMainThreadNullState state;
     g_return_if_fail(WEBKIT_DOM_IS_HTML_TABLE_CELL_ELEMENT(self));
     WebCore::HTMLTableCellElement* item = WebKit::core(self);
-    item->setColSpanForBindings(value);
+    item->setColSpan(value);
 }
 
 glong webkit_dom_html_table_cell_element_get_row_span(WebKitDOMHTMLTableCellElement* self)

Modified: trunk/Tools/TestWebKitAPI/Tests/WebCore/HTMLParserIdioms.cpp (215913 => 215914)


--- trunk/Tools/TestWebKitAPI/Tests/WebCore/HTMLParserIdioms.cpp	2017-04-28 01:32:30 UTC (rev 215913)
+++ trunk/Tools/TestWebKitAPI/Tests/WebCore/HTMLParserIdioms.cpp	2017-04-28 01:53:56 UTC (rev 215914)
@@ -37,7 +37,7 @@
 {
     auto optionalResult = parseHTMLInteger(input);
     EXPECT_TRUE(!!optionalResult);
-    return optionalResult.value_or(0);
+    return optionalResult.valueOr(0);
 }
 
 static bool parseHTMLIntegerFails(const String& input)
@@ -101,7 +101,7 @@
 {
     auto optionalResult = parseHTMLNonNegativeInteger(input);
     EXPECT_TRUE(!!optionalResult);
-    return optionalResult.value_or(0);
+    return optionalResult.valueOr(0);
 }
 
 static bool parseHTMLNonNegativeIntegerFails(const String& input)
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to