Title: [218541] releases/WebKitGTK/webkit-2.16
- Revision
- 218541
- Author
- [email protected]
- Date
- 2017-06-19 23:37:27 -0700 (Mon, 19 Jun 2017)
Log Message
Merge r217473 - imported/w3c/web-platform-tests/html/semantics/forms/form-control-infrastructure/form_owner_and_table_2.html is crashing
https://bugs.webkit.org/show_bug.cgi?id=172628
<rdar://problem/32418707>
Reviewed by Sam Weinig.
Source/WebCore:
In the event where a form is removed synchronously by a script during parsing,
FormAssociatedElement::m_formSetByParser may end up referring to a form that
is no longer in the document. As a result, we should make sure m_formSetByParser
is still connected in FormAssociatedElement::insertedInto() before we call
FormAssociatedElement::setForm(m_formSetByParser).
Test: fast/dom/HTMLFormElement/form-removed-during-parsing-crash.html
* html/FormAssociatedElement.cpp:
(WebCore::FormAssociatedElement::insertedInto):
LayoutTests:
Add reduced test case.
* TestExpectations:
Unskip test that is no longer crashing in debug builds.
* fast/dom/HTMLFormElement/form-removed-during-parsing-crash-expected.txt: Added.
* fast/dom/HTMLFormElement/form-removed-during-parsing-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog (218540 => 218541)
--- releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog 2017-06-20 06:35:22 UTC (rev 218540)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog 2017-06-20 06:37:27 UTC (rev 218541)
@@ -1,3 +1,19 @@
+2017-05-25 Chris Dumez <[email protected]>
+
+ imported/w3c/web-platform-tests/html/semantics/forms/form-control-infrastructure/form_owner_and_table_2.html is crashing
+ https://bugs.webkit.org/show_bug.cgi?id=172628
+ <rdar://problem/32418707>
+
+ Reviewed by Sam Weinig.
+
+ Add reduced test case.
+
+ * TestExpectations:
+ Unskip test that is no longer crashing in debug builds.
+
+ * fast/dom/HTMLFormElement/form-removed-during-parsing-crash-expected.txt: Added.
+ * fast/dom/HTMLFormElement/form-removed-during-parsing-crash.html: Added.
+
2017-05-25 Zalan Bujtas <[email protected]>
Frame's composited content is visible when the frame has visibility: hidden.
Added: releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/HTMLFormElement/form-removed-during-parsing-crash-expected.txt (0 => 218541)
--- releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/HTMLFormElement/form-removed-during-parsing-crash-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/HTMLFormElement/form-removed-during-parsing-crash-expected.txt 2017-06-20 06:37:27 UTC (rev 218541)
@@ -0,0 +1,12 @@
+This test passes if it does not crash
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS document.getElementById('input1').form is null
+PASS document.getElementById('input2').form is null
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
+
Added: releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/HTMLFormElement/form-removed-during-parsing-crash.html (0 => 218541)
--- releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/HTMLFormElement/form-removed-during-parsing-crash.html (rev 0)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/HTMLFormElement/form-removed-during-parsing-crash.html 2017-06-20 06:37:27 UTC (rev 218541)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src=""
+<script>
+description("This test passes if it does not crash");
+</script>
+<table id='table1'>
+ <form id='form1'>
+ <script>
+ document.getElementById('form1').remove();
+ gc();
+ </script>
+ <tr><td><input id='input1'></td></tr>
+ <tr><td><input id='input2' form="form1"></td></tr>
+</table>
+<script>
+shouldBeNull("document.getElementById('input1').form");
+shouldBeNull("document.getElementById('input2').form");
+</script>
+</body>
+</html>
Modified: releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog (218540 => 218541)
--- releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog 2017-06-20 06:35:22 UTC (rev 218540)
+++ releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog 2017-06-20 06:37:27 UTC (rev 218541)
@@ -1,3 +1,22 @@
+2017-05-25 Chris Dumez <[email protected]>
+
+ imported/w3c/web-platform-tests/html/semantics/forms/form-control-infrastructure/form_owner_and_table_2.html is crashing
+ https://bugs.webkit.org/show_bug.cgi?id=172628
+ <rdar://problem/32418707>
+
+ Reviewed by Sam Weinig.
+
+ In the event where a form is removed synchronously by a script during parsing,
+ FormAssociatedElement::m_formSetByParser may end up referring to a form that
+ is no longer in the document. As a result, we should make sure m_formSetByParser
+ is still connected in FormAssociatedElement::insertedInto() before we call
+ FormAssociatedElement::setForm(m_formSetByParser).
+
+ Test: fast/dom/HTMLFormElement/form-removed-during-parsing-crash.html
+
+ * html/FormAssociatedElement.cpp:
+ (WebCore::FormAssociatedElement::insertedInto):
+
2017-05-25 Zalan Bujtas <[email protected]>
Frame's composited content is visible when the frame has visibility: hidden.
Modified: releases/WebKitGTK/webkit-2.16/Source/WebCore/html/FormAssociatedElement.cpp (218540 => 218541)
--- releases/WebKitGTK/webkit-2.16/Source/WebCore/html/FormAssociatedElement.cpp 2017-06-20 06:35:22 UTC (rev 218540)
+++ releases/WebKitGTK/webkit-2.16/Source/WebCore/html/FormAssociatedElement.cpp 2017-06-20 06:37:27 UTC (rev 218541)
@@ -71,7 +71,9 @@
{
HTMLElement& element = asHTMLElement();
if (m_formSetByParser) {
- setForm(m_formSetByParser);
+ // The form could have been removed by a script during parsing.
+ if (m_formSetByParser->isConnected())
+ setForm(m_formSetByParser);
m_formSetByParser = nullptr;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
