Title: [122831] trunk/Source/WebCore
- Revision
- 122831
- Author
- [email protected]
- Date
- 2012-07-17 02:59:36 -0700 (Tue, 17 Jul 2012)
Log Message
"in body" insertion mode, "any other end tag" step 2.1 is updated
https://bugs.webkit.org/show_bug.cgi?id=91473
Patch by Kwang Yul Seo <[email protected]> on 2012-07-17
Reviewed by Eric Seidel.
The HTML5 spec is updated to change the 'end tag' processing to not imply
its own end tag, since that makes no sense. Step 2.1 now says
"Generate implied end tags, except for elements with the same tag name as the token."
Modified to follow the updated spec. Also removed the first FIXME because now
ElementRecord can't be deleted by the preceeding call.
This patch does not actually change the behavior because of the previous
check (aborts if generateImpliedEndTags has already popped the node for the token),
so no new tests.
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (122830 => 122831)
--- trunk/Source/WebCore/ChangeLog 2012-07-17 09:45:25 UTC (rev 122830)
+++ trunk/Source/WebCore/ChangeLog 2012-07-17 09:59:36 UTC (rev 122831)
@@ -1,3 +1,23 @@
+2012-07-17 Kwang Yul Seo <[email protected]>
+
+ "in body" insertion mode, "any other end tag" step 2.1 is updated
+ https://bugs.webkit.org/show_bug.cgi?id=91473
+
+ Reviewed by Eric Seidel.
+
+ The HTML5 spec is updated to change the 'end tag' processing to not imply
+ its own end tag, since that makes no sense. Step 2.1 now says
+ "Generate implied end tags, except for elements with the same tag name as the token."
+ Modified to follow the updated spec. Also removed the first FIXME because now
+ ElementRecord can't be deleted by the preceeding call.
+
+ This patch does not actually change the behavior because of the previous
+ check (aborts if generateImpliedEndTags has already popped the node for the token),
+ so no new tests.
+
+ * html/parser/HTMLTreeBuilder.cpp:
+ (WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):
+
2012-07-17 Shinya Kawanaka <[email protected]>
[Regression] Infinite loop in document.elementFromPoint
Modified: trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp (122830 => 122831)
--- trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2012-07-17 09:45:25 UTC (rev 122830)
+++ trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2012-07-17 09:59:36 UTC (rev 122831)
@@ -1468,21 +1468,9 @@
while (1) {
RefPtr<ContainerNode> node = record->node();
if (node->hasLocalName(token.name())) {
- m_tree.generateImpliedEndTags();
- // FIXME: The ElementRecord pointed to by record might be deleted by
- // the preceding call. Perhaps we should hold a RefPtr so that it
- // stays alive for the duration of record's scope.
- record = 0;
- if (!m_tree.currentNode()->hasLocalName(token.name())) {
+ m_tree.generateImpliedEndTagsWithExclusion(token.name());
+ if (!m_tree.currentNode()->hasLocalName(token.name()))
parseError(token);
- // FIXME: This is either a bug in the spec, or a bug in our
- // implementation. Filed a bug with HTML5:
- // http://www.w3.org/Bugs/Public/show_bug.cgi?id=10080
- // We might have already popped the node for the token in
- // generateImpliedEndTags, just abort.
- if (!m_tree.openElements()->contains(toElement(node.get())))
- return;
- }
m_tree.openElements()->popUntilPopped(toElement(node.get()));
return;
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
