Title: [213438] trunk
- Revision
- 213438
- Author
- cdu...@apple.com
- Date
- 2017-03-05 17:36:30 -0800 (Sun, 05 Mar 2017)
Log Message
Using <form> in <template> causes following <form> to get swallowed
https://bugs.webkit.org/show_bug.cgi?id=163552
Reviewed by Sam Weinig.
Source/WebCore:
As per the HTML specification [1], when finding a "form" tag in the "in body"
insertion mode, we should insert an HTML element for the token, and, if there
is no template element on the stack of open elements, set the form element
pointer to point to the element created.
We were missing the "if there is no template element on the stack of open
elements" check and setting the form element pointer unconditionally.
This patch fixes the issue.
[1] https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody:form-element-pointer-2
Test: fast/parser/form-after-template.html
* html/parser/HTMLConstructionSite.cpp:
(WebCore::HTMLConstructionSite::insertHTMLFormElement):
LayoutTests:
Add layout test coverage.
* fast/parser/form-after-template-expected.html: Added.
* fast/parser/form-after-template.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (213437 => 213438)
--- trunk/LayoutTests/ChangeLog 2017-03-05 20:31:06 UTC (rev 213437)
+++ trunk/LayoutTests/ChangeLog 2017-03-06 01:36:30 UTC (rev 213438)
@@ -1,3 +1,15 @@
+2017-03-05 Chris Dumez <cdu...@apple.com>
+
+ Using <form> in <template> causes following <form> to get swallowed
+ https://bugs.webkit.org/show_bug.cgi?id=163552
+
+ Reviewed by Sam Weinig.
+
+ Add layout test coverage.
+
+ * fast/parser/form-after-template-expected.html: Added.
+ * fast/parser/form-after-template.html: Added.
+
2017-03-04 Myles C. Maxfield <mmaxfi...@apple.com>
Update CSSFontSelector's matching algorithm to understand ranges
Added: trunk/LayoutTests/fast/parser/form-after-template-expected.html (0 => 213438)
--- trunk/LayoutTests/fast/parser/form-after-template-expected.html (rev 0)
+++ trunk/LayoutTests/fast/parser/form-after-template-expected.html 2017-03-06 01:36:30 UTC (rev 213438)
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test that the form following a template element properly gets parsed.</p>
+<form style="background-color:red;">
+ <input type="text" /><button>Submit</button>
+</form>
+</body>
+</html>
Added: trunk/LayoutTests/fast/parser/form-after-template.html (0 => 213438)
--- trunk/LayoutTests/fast/parser/form-after-template.html (rev 0)
+++ trunk/LayoutTests/fast/parser/form-after-template.html 2017-03-06 01:36:30 UTC (rev 213438)
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test that the form following a template element properly gets parsed.</p>
+<template><form></form></template>
+<form style="background-color:red;">
+ <input type="text" /><button>Submit</button>
+</form>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (213437 => 213438)
--- trunk/Source/WebCore/ChangeLog 2017-03-05 20:31:06 UTC (rev 213437)
+++ trunk/Source/WebCore/ChangeLog 2017-03-06 01:36:30 UTC (rev 213438)
@@ -1,3 +1,26 @@
+2017-03-05 Chris Dumez <cdu...@apple.com>
+
+ Using <form> in <template> causes following <form> to get swallowed
+ https://bugs.webkit.org/show_bug.cgi?id=163552
+
+ Reviewed by Sam Weinig.
+
+ As per the HTML specification [1], when finding a "form" tag in the "in body"
+ insertion mode, we should insert an HTML element for the token, and, if there
+ is no template element on the stack of open elements, set the form element
+ pointer to point to the element created.
+
+ We were missing the "if there is no template element on the stack of open
+ elements" check and setting the form element pointer unconditionally.
+ This patch fixes the issue.
+
+ [1] https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody:form-element-pointer-2
+
+ Test: fast/parser/form-after-template.html
+
+ * html/parser/HTMLConstructionSite.cpp:
+ (WebCore::HTMLConstructionSite::insertHTMLFormElement):
+
2017-03-04 Myles C. Maxfield <mmaxfi...@apple.com>
Update CSSFontSelector's matching algorithm to understand ranges
Modified: trunk/Source/WebCore/html/parser/HTMLConstructionSite.cpp (213437 => 213438)
--- trunk/Source/WebCore/html/parser/HTMLConstructionSite.cpp 2017-03-05 20:31:06 UTC (rev 213437)
+++ trunk/Source/WebCore/html/parser/HTMLConstructionSite.cpp 2017-03-06 01:36:30 UTC (rev 213438)
@@ -476,10 +476,14 @@
void HTMLConstructionSite::insertHTMLFormElement(AtomicHTMLToken&& token, bool isDemoted)
{
auto element = createHTMLElement(token);
- m_form = &downcast<HTMLFormElement>(element.get());
- m_form->setDemoted(isDemoted);
- attachLater(currentNode(), *m_form);
- m_openElements.push(HTMLStackItem::create(*m_form, WTFMove(token)));
+ auto& formElement = downcast<HTMLFormElement>(element.get());
+ // If there is no template element on the stack of open elements, set the
+ // form element pointer to point to the element created.
+ if (!openElements().hasTemplateInHTMLScope())
+ m_form = &formElement;
+ formElement.setDemoted(isDemoted);
+ attachLater(currentNode(), formElement);
+ m_openElements.push(HTMLStackItem::create(formElement, WTFMove(token)));
}
void HTMLConstructionSite::insertHTMLElement(AtomicHTMLToken&& token)
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
