Title: [213811] releases/WebKitGTK/webkit-2.16
- Revision
- 213811
- Author
- [email protected]
- Date
- 2017-03-13 03:38:43 -0700 (Mon, 13 Mar 2017)
Log Message
Merge r213438 - Using <form> in <template> causes following <form> to get swallowed
https://bugs.webkit.org/show_bug.cgi?id=163552
Reviewed by Sam Weinig.
Source/WebCore:
As per the HTML specification [1], when finding a "form" tag in the "in body"
insertion mode, we should insert an HTML element for the token, and, if there
is no template element on the stack of open elements, set the form element
pointer to point to the element created.
We were missing the "if there is no template element on the stack of open
elements" check and setting the form element pointer unconditionally.
This patch fixes the issue.
[1] https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody:form-element-pointer-2
Test: fast/parser/form-after-template.html
* html/parser/HTMLConstructionSite.cpp:
(WebCore::HTMLConstructionSite::insertHTMLFormElement):
LayoutTests:
Add layout test coverage.
* fast/parser/form-after-template-expected.html: Added.
* fast/parser/form-after-template.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog (213810 => 213811)
--- releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog 2017-03-13 10:37:34 UTC (rev 213810)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog 2017-03-13 10:38:43 UTC (rev 213811)
@@ -1,3 +1,15 @@
+2017-03-05 Chris Dumez <[email protected]>
+
+ Using <form> in <template> causes following <form> to get swallowed
+ https://bugs.webkit.org/show_bug.cgi?id=163552
+
+ Reviewed by Sam Weinig.
+
+ Add layout test coverage.
+
+ * fast/parser/form-after-template-expected.html: Added.
+ * fast/parser/form-after-template.html: Added.
+
2017-03-03 Alex Christensen <[email protected]>
[URLParser] Fix file: as a relative file URL
Added: releases/WebKitGTK/webkit-2.16/LayoutTests/fast/parser/form-after-template-expected.html (0 => 213811)
--- releases/WebKitGTK/webkit-2.16/LayoutTests/fast/parser/form-after-template-expected.html (rev 0)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/fast/parser/form-after-template-expected.html 2017-03-13 10:38:43 UTC (rev 213811)
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test that the form following a template element properly gets parsed.</p>
+<form style="background-color:red;">
+ <input type="text" /><button>Submit</button>
+</form>
+</body>
+</html>
Added: releases/WebKitGTK/webkit-2.16/LayoutTests/fast/parser/form-after-template.html (0 => 213811)
--- releases/WebKitGTK/webkit-2.16/LayoutTests/fast/parser/form-after-template.html (rev 0)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/fast/parser/form-after-template.html 2017-03-13 10:38:43 UTC (rev 213811)
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Test that the form following a template element properly gets parsed.</p>
+<template><form></form></template>
+<form style="background-color:red;">
+ <input type="text" /><button>Submit</button>
+</form>
+</body>
+</html>
Modified: releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog (213810 => 213811)
--- releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog 2017-03-13 10:37:34 UTC (rev 213810)
+++ releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog 2017-03-13 10:38:43 UTC (rev 213811)
@@ -1,3 +1,26 @@
+2017-03-05 Chris Dumez <[email protected]>
+
+ Using <form> in <template> causes following <form> to get swallowed
+ https://bugs.webkit.org/show_bug.cgi?id=163552
+
+ Reviewed by Sam Weinig.
+
+ As per the HTML specification [1], when finding a "form" tag in the "in body"
+ insertion mode, we should insert an HTML element for the token, and, if there
+ is no template element on the stack of open elements, set the form element
+ pointer to point to the element created.
+
+ We were missing the "if there is no template element on the stack of open
+ elements" check and setting the form element pointer unconditionally.
+ This patch fixes the issue.
+
+ [1] https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody:form-element-pointer-2
+
+ Test: fast/parser/form-after-template.html
+
+ * html/parser/HTMLConstructionSite.cpp:
+ (WebCore::HTMLConstructionSite::insertHTMLFormElement):
+
2017-03-05 Simon Fraser <[email protected]>
Make some RenderLayer tree traversal in RenderLayerBacking more generic
Modified: releases/WebKitGTK/webkit-2.16/Source/WebCore/html/parser/HTMLConstructionSite.cpp (213810 => 213811)
--- releases/WebKitGTK/webkit-2.16/Source/WebCore/html/parser/HTMLConstructionSite.cpp 2017-03-13 10:37:34 UTC (rev 213810)
+++ releases/WebKitGTK/webkit-2.16/Source/WebCore/html/parser/HTMLConstructionSite.cpp 2017-03-13 10:38:43 UTC (rev 213811)
@@ -476,10 +476,14 @@
void HTMLConstructionSite::insertHTMLFormElement(AtomicHTMLToken&& token, bool isDemoted)
{
auto element = createHTMLElement(token);
- m_form = &downcast<HTMLFormElement>(element.get());
- m_form->setDemoted(isDemoted);
- attachLater(currentNode(), *m_form);
- m_openElements.push(HTMLStackItem::create(*m_form, WTFMove(token)));
+ auto& formElement = downcast<HTMLFormElement>(element.get());
+ // If there is no template element on the stack of open elements, set the
+ // form element pointer to point to the element created.
+ if (!openElements().hasTemplateInHTMLScope())
+ m_form = &formElement;
+ formElement.setDemoted(isDemoted);
+ attachLater(currentNode(), formElement);
+ m_openElements.push(HTMLStackItem::create(formElement, WTFMove(token)));
}
void HTMLConstructionSite::insertHTMLElement(AtomicHTMLToken&& token)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
