Title: [119337] releases/WebKitGTK/webkit-1.8
- Revision
- 119337
- Author
- [email protected]
- Date
- 2012-06-02 13:31:42 -0700 (Sat, 02 Jun 2012)
Log Message
Merge 108311 - Invalid cast in WebCore::toElement / WebCore::HTMLElementStack::ElementRecord::element
https://bugs.webkit.org/show_bug.cgi?id=78975
Reviewed by Eric Seidel.
Source/WebCore:
We're supposed to set the action attribute on the form element we just
created. Previously, we assumed the newly created form element would
be on the top of the stack of open elements, but if we're in the table
body insertion mode, the form element gets treated as self closing and
is therefore popped off the stack of open elements.
Fortunately, we already cache a pointer to the most recently inserted
form element on the HTMLConstructionSite, so we can just grab the
element from there.
Test: html5lib/runner.html
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::processIsindexStartTagForInBody):
(WebCore):
LayoutTests:
* html5lib/resourcesl/webkit-02.dat:
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-1.8/LayoutTests/ChangeLog (119336 => 119337)
--- releases/WebKitGTK/webkit-1.8/LayoutTests/ChangeLog 2012-06-02 20:31:25 UTC (rev 119336)
+++ releases/WebKitGTK/webkit-1.8/LayoutTests/ChangeLog 2012-06-02 20:31:42 UTC (rev 119337)
@@ -1,3 +1,12 @@
+2012-02-20 Adam Barth <[email protected]>
+
+ Invalid cast in WebCore::toElement / WebCore::HTMLElementStack::ElementRecord::element
+ https://bugs.webkit.org/show_bug.cgi?id=78975
+
+ Reviewed by Eric Seidel.
+
+ * html5lib/resourcesl/webkit-02.dat:
+
2012-04-30 Justin Schuh <[email protected]>
loadOrRedirectSubframe should return the owner element's frame
Modified: releases/WebKitGTK/webkit-1.8/LayoutTests/html5lib/resources/webkit02.dat (119336 => 119337)
--- releases/WebKitGTK/webkit-1.8/LayoutTests/html5lib/resources/webkit02.dat 2012-06-02 20:31:25 UTC (rev 119336)
+++ releases/WebKitGTK/webkit-1.8/LayoutTests/html5lib/resources/webkit02.dat 2012-06-02 20:31:42 UTC (rev 119337)
@@ -134,3 +134,18 @@
| <aside>
| <em>
| <b>
+
+#data
+<isindex action=""
+#errors
+#document-fragment
+table
+#document
+| <form>
+| action=""
+| <hr>
+| <label>
+| "This is a searchable index. Enter search keywords: "
+| <input>
+| name="isindex"
+| <hr>
Modified: releases/WebKitGTK/webkit-1.8/Source/WebCore/ChangeLog (119336 => 119337)
--- releases/WebKitGTK/webkit-1.8/Source/WebCore/ChangeLog 2012-06-02 20:31:25 UTC (rev 119336)
+++ releases/WebKitGTK/webkit-1.8/Source/WebCore/ChangeLog 2012-06-02 20:31:42 UTC (rev 119337)
@@ -1,3 +1,26 @@
+2012-02-20 Adam Barth <[email protected]>
+
+ Invalid cast in WebCore::toElement / WebCore::HTMLElementStack::ElementRecord::element
+ https://bugs.webkit.org/show_bug.cgi?id=78975
+
+ Reviewed by Eric Seidel.
+
+ We're supposed to set the action attribute on the form element we just
+ created. Previously, we assumed the newly created form element would
+ be on the top of the stack of open elements, but if we're in the table
+ body insertion mode, the form element gets treated as self closing and
+ is therefore popped off the stack of open elements.
+
+ Fortunately, we already cache a pointer to the most recently inserted
+ form element on the HTMLConstructionSite, so we can just grab the
+ element from there.
+
+ Test: html5lib/runner.html
+
+ * html/parser/HTMLTreeBuilder.cpp:
+ (WebCore::HTMLTreeBuilder::processIsindexStartTagForInBody):
+ (WebCore):
+
2012-04-30 Justin Schuh <[email protected]>
loadOrRedirectSubframe should return the owner element's frame
Modified: releases/WebKitGTK/webkit-1.8/Source/WebCore/html/parser/HTMLTreeBuilder.cpp (119336 => 119337)
--- releases/WebKitGTK/webkit-1.8/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2012-06-02 20:31:25 UTC (rev 119336)
+++ releases/WebKitGTK/webkit-1.8/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2012-06-02 20:31:42 UTC (rev 119337)
@@ -586,10 +586,8 @@
notImplemented(); // Acknowledge self-closing flag
processFakeStartTag(formTag);
RefPtr<Attribute> actionAttribute = token.getAttributeItem(actionAttr);
- if (actionAttribute) {
- ASSERT(m_tree.currentElement()->hasTagName(formTag));
- m_tree.currentElement()->setAttribute(actionAttr, actionAttribute->value());
- }
+ if (actionAttribute)
+ m_tree.form()->setAttribute(actionAttr, actionAttribute->value());
processFakeStartTag(hrTag);
processFakeStartTag(labelTag);
RefPtr<Attribute> promptAttribute = token.getAttributeItem(promptAttr);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
