Title: [219811] releases/WebKitGTK/webkit-2.16
- Revision
- 219811
- Author
- [email protected]
- Date
- 2017-07-24 03:53:23 -0700 (Mon, 24 Jul 2017)
Log Message
Merge r216813 - Elements should be inserted into a template element as its content's last child
https://bugs.webkit.org/show_bug.cgi?id=171373
<rdar://problem/31862949>
Reviewed by Ryosuke Niwa.
Source/WebCore:
Before this change, our HTML parser obeys the following premises:
1) A fostering child whose parent is a table should be inserted before its parent and under its grandparent.
2) When inserting into a template element, an element should be inserted into its content.
Let's walk through the example:
a) Before eventhandler takes place
template
table
svg <- parser
b) After eventhandler takes place
template
table
svg <- parser
c) after parsing svg
template
content
svg
(table)
table
Finally, in the example, the svg element will be inserted into the content of the template element while
having its next sibling point to the table element. However, the table element is actually under the
template element not its content.
This messy tree is constructed because the second premise is incompleted. It should be: When inserting into
a template element, an element should be inserted into its content as its last child.
Quoted from Step 3 of https://html.spec.whatwg.org/multipage/syntax.html#appropriate-place-for-inserting-a-node
A correct tree will then looks like:
template
content
svg
table
Tests: fast/dom/HTMLTemplateElement/insert-fostering-child-crash.html
fast/dom/HTMLTemplateElement/insert-fostering-child.html
* html/parser/HTMLConstructionSite.cpp:
(WebCore::insert):
By nullifying task.nextChild, it will force the parser to append the element as task.parent's last child.
LayoutTests:
* fast/dom/HTMLTemplateElement/insert-fostering-child-expected.txt: Added.
* fast/dom/HTMLTemplateElement/insert-fostering-child.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog (219810 => 219811)
--- releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog 2017-07-24 10:51:10 UTC (rev 219810)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog 2017-07-24 10:53:23 UTC (rev 219811)
@@ -1,3 +1,14 @@
+2017-05-12 Jiewen Tan <[email protected]>
+
+ Elements should be inserted into a template element as its content's last child
+ https://bugs.webkit.org/show_bug.cgi?id=171373
+ <rdar://problem/31862949>
+
+ Reviewed by Ryosuke Niwa.
+
+ * fast/dom/HTMLTemplateElement/insert-fostering-child-expected.txt: Added.
+ * fast/dom/HTMLTemplateElement/insert-fostering-child.html: Added.
+
2017-05-15 Jiewen Tan <[email protected]>
Replace CryptoOperationData with BufferSource for WebKitSubtleCrypto
Added: releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/HTMLTemplateElement/insert-fostering-child-expected.txt (0 => 219811)
--- releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/HTMLTemplateElement/insert-fostering-child-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/HTMLTemplateElement/insert-fostering-child-expected.txt 2017-07-24 10:53:23 UTC (rev 219811)
@@ -0,0 +1,12 @@
+Test inserting a fostering child into HTMLTemplateElement
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS template.firstChild is table
+PASS template.content.lastChild is svg
+PASS svg.nextSibling is null
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/HTMLTemplateElement/insert-fostering-child.html (0 => 219811)
--- releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/HTMLTemplateElement/insert-fostering-child.html (rev 0)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/HTMLTemplateElement/insert-fostering-child.html 2017-07-24 10:53:23 UTC (rev 219811)
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script src=""
+ <script>
+ jsTestIsAsync = true;
+
+ function checkOrder()
+ {
+ description('Test inserting a fostering child into HTMLTemplateElement');
+ shouldBe('template.firstChild', 'table');
+ svg = template.content.querySelector("svg");
+ shouldBe('template.content.lastChild', 'svg');
+ shouldBeNull('svg.nextSibling');
+ finishJSTest();
+ }
+
+ function eventhandler()
+ {
+ template.appendChild(table);
+ }
+ </script>
+</head>
+<!--The body element intends to be messy.-->
+<body _onload_=checkOrder()>
+ <template id="template">
+ </template>
+ <style _onload_="eventhandler()"></style>
+ <table id="table">
+ <iframe></iframe>
+ <svg></svg>
+ </table>
+</body>
+<script src=""
+</html>
\ No newline at end of file
Modified: releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog (219810 => 219811)
--- releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog 2017-07-24 10:51:10 UTC (rev 219810)
+++ releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog 2017-07-24 10:53:23 UTC (rev 219811)
@@ -1,3 +1,51 @@
+2017-05-12 Jiewen Tan <[email protected]>
+
+ Elements should be inserted into a template element as its content's last child
+ https://bugs.webkit.org/show_bug.cgi?id=171373
+ <rdar://problem/31862949>
+
+ Reviewed by Ryosuke Niwa.
+
+ Before this change, our HTML parser obeys the following premises:
+ 1) A fostering child whose parent is a table should be inserted before its parent and under its grandparent.
+ 2) When inserting into a template element, an element should be inserted into its content.
+
+ Let's walk through the example:
+ a) Before eventhandler takes place
+ template
+ table
+ svg <- parser
+ b) After eventhandler takes place
+ template
+ table
+ svg <- parser
+ c) after parsing svg
+ template
+ content
+ svg
+ (table)
+ table
+
+ Finally, in the example, the svg element will be inserted into the content of the template element while
+ having its next sibling point to the table element. However, the table element is actually under the
+ template element not its content.
+
+ This messy tree is constructed because the second premise is incompleted. It should be: When inserting into
+ a template element, an element should be inserted into its content as its last child.
+ Quoted from Step 3 of https://html.spec.whatwg.org/multipage/syntax.html#appropriate-place-for-inserting-a-node
+ A correct tree will then looks like:
+ template
+ content
+ svg
+ table
+
+ Tests: fast/dom/HTMLTemplateElement/insert-fostering-child-crash.html
+ fast/dom/HTMLTemplateElement/insert-fostering-child.html
+
+ * html/parser/HTMLConstructionSite.cpp:
+ (WebCore::insert):
+ By nullifying task.nextChild, it will force the parser to append the element as task.parent's last child.
+
2017-05-15 Jiewen Tan <[email protected]>
Replace CryptoOperationData with BufferSource for WebKitSubtleCrypto
Modified: releases/WebKitGTK/webkit-2.16/Source/WebCore/html/parser/HTMLConstructionSite.cpp (219810 => 219811)
--- releases/WebKitGTK/webkit-2.16/Source/WebCore/html/parser/HTMLConstructionSite.cpp 2017-07-24 10:51:10 UTC (rev 219810)
+++ releases/WebKitGTK/webkit-2.16/Source/WebCore/html/parser/HTMLConstructionSite.cpp 2017-07-24 10:53:23 UTC (rev 219811)
@@ -102,8 +102,10 @@
static inline void insert(HTMLConstructionSiteTask& task)
{
- if (is<HTMLTemplateElement>(*task.parent))
+ if (is<HTMLTemplateElement>(*task.parent)) {
task.parent = &downcast<HTMLTemplateElement>(*task.parent).content();
+ task.nextChild = nullptr;
+ }
ASSERT(!task.child->parentNode());
if (task.nextChild)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
