Title: [130422] trunk
- Revision
- 130422
- Author
- [email protected]
- Date
- 2012-10-04 13:09:42 -0700 (Thu, 04 Oct 2012)
Log Message
Layout broken after cloning and re-inserting a table with a misplaced <form>
https://bugs.webkit.org/show_bug.cgi?id=86746
Patch by Pravin D <[email protected]> on 2012-10-04
Reviewed by Julien Chaffraix.
Source/WebCore:
There is a concept of demotion for a <form> contained in a table. A <form> is demoted if its immediate parent
is either a <table>, table sections (tbody, etc) or a table row (tr). A renderer for such a <form> is created only
if its display is one of the table display types (TABLE, INLINE_TABLE, TABLE_FOOTER_GROUP, etc).
However when a <table> containing a demoted <form> is cloned, the <form> does not retain its demotion state and
results in the table getting improperly rendered.
Test: fast/table/form-with-non-table-display-inside-table-elements.html
* html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::copyNonAttributePropertiesFromElement):
Extended the virtual function for HTMLFormElement class specific implementation.
The function is used to copy any necessary state information(member variables) associated with
the <form> element being cloned to the current node.
For HTMLFormElement node the member variable can be classified into five groups based on the
information they hold:
1) Variables containing information regarding <form> subtree and elements associated with it.
These get updated as and when an element is added to the <form> subtree.
2) Variables containing <form> submit state information.
3) Flag to hold information if reset() has been called.
4) Flag(m_wasDemoted) that indicates whether the form is demoted or not, based on which it needs to
be handled differently during creation of its renderer.
This information is currently being updated only during the HTML tree construction phase.
5) Flag(m_wasMalformed) to hold information if the <form> is malformed or not.
Variables of group (1) will be updated as and when elements are added to the <form> subtree. Whereas,
(2) and (3) hold instance specific information, thus copying them is not required. Also (5) is currently not
being used(not set by any code).
On the other hand, (4) is required to be copied during cloning as this information cannot be accessed
during the cloning process.
(WebCore):
* html/HTMLFormElement.h:
Added copyNonAttributePropertiesFromElement() declaration.
LayoutTests:
* fast/table/form-with-non-table-display-inside-table-elements-expected.txt: Added.
* fast/table/form-with-non-table-display-inside-table-elements.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (130421 => 130422)
--- trunk/LayoutTests/ChangeLog 2012-10-04 20:01:12 UTC (rev 130421)
+++ trunk/LayoutTests/ChangeLog 2012-10-04 20:09:42 UTC (rev 130422)
@@ -1,3 +1,13 @@
+2012-10-04 Pravin D <[email protected]>
+
+ Layout broken after cloning and re-inserting a table with a misplaced <form>
+ https://bugs.webkit.org/show_bug.cgi?id=86746
+
+ Reviewed by Julien Chaffraix.
+
+ * fast/table/form-with-non-table-display-inside-table-elements-expected.txt: Added.
+ * fast/table/form-with-non-table-display-inside-table-elements.html: Added.
+
2012-10-04 Ryosuke Niwa <[email protected]>
Qt rebaseline after r130411.
Added: trunk/LayoutTests/fast/table/form-with-non-table-display-inside-table-elements-expected.txt (0 => 130422)
--- trunk/LayoutTests/fast/table/form-with-non-table-display-inside-table-elements-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/table/form-with-non-table-display-inside-table-elements-expected.txt 2012-10-04 20:09:42 UTC (rev 130422)
@@ -0,0 +1,18 @@
+Testcase for bug http://webkit.org/b/86746. A form element whose immediate parent is either a table, table section or a table row is considered as a demoted element.
+Renderer for such an element is not created when its display is to a non table type (Eg. BLOCK, INLINE, etc). However when a table containing form element is cloned,
+the form element is not properly demoted. This results in the creation of an unexpected renderer for the form element.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+Expected: The tables should contain only one row of width 150px and one column of height 20px.
+
+PASS clonedTable.getBoundingClientRect().width is 150
+PASS clonedTable.getBoundingClientRect().height is 20
+PASS clonedTable.getBoundingClientRect().width is 150
+PASS clonedTable.getBoundingClientRect().height is 20
+PASS clonedTable.getBoundingClientRect().width is 150
+PASS clonedTable.getBoundingClientRect().height is 20
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/table/form-with-non-table-display-inside-table-elements.html (0 => 130422)
--- trunk/LayoutTests/fast/table/form-with-non-table-display-inside-table-elements.html (rev 0)
+++ trunk/LayoutTests/fast/table/form-with-non-table-display-inside-table-elements.html 2012-10-04 20:09:42 UTC (rev 130422)
@@ -0,0 +1,77 @@
+<!DOCTYPE html>
+<html>
+<body>
+<style>
+table {
+ background:red;
+ border-spacing:0;
+ border-collapse:collapse;
+ display:none
+}
+
+td {
+ width:148px;
+ background:green;
+ height:18px;
+}
+form {
+ width:50px;
+ height:20px;
+}
+</style>
+<script src=""
+<div id="testCases">
+<div id="case1">
+ <p> CASE 1 : Form element inside table.</p>
+ <table>
+ <form></form>
+ <tr>
+ <td></td>
+ </tr>
+ </table>
+</div>
+<div id="case2">
+ <p> CASE 2 : Form element inside table section(tbody,thead or tfoot).</p>
+ <table>
+ <tbody>
+ <form></form>
+ <tr>
+ <td></td>
+ </tr>
+ </tbody>
+ </table>
+</div>
+<div id="case3">
+ <p> CASE 3 : Form element inside table row.</p>
+ <table>
+ <tr>
+ <form></form>
+ <td></td>
+ </tr>
+ </table>
+</div>
+</div>
+<div id="description"></div>
+<div id="console"></div>
+<script>
+description('Testcase for bug <a href="" A form element whose immediate parent is either a table, \
+table section or a table row is considered as a demoted element. <br>Renderer for such an element is not created when its display is to a \
+non table type (Eg. BLOCK, INLINE, etc). However when a table containing form element is cloned, <br>the form element is not properly demoted. \
+This results in the creation of an unexpected renderer for the form element.');
+debug('Expected: The tables should contain only one row of width 150px and one column of height 20px.<br>');
+
+for(var i = 1; i <=3; i++) {
+ var container = document.getElementById('case' + i);
+ clonedTable = container.getElementsByTagName("TABLE")[0].cloneNode(true);
+ clonedTable.style.display = 'table';
+ container.appendChild(clonedTable);
+ shouldBe('clonedTable.getBoundingClientRect().width', '150');
+ shouldBe('clonedTable.getBoundingClientRect().height', '20');
+}
+
+var testCasesContainer = document.getElementById('testCases');
+document.body.removeChild(testCasesContainer);
+</script>
+<script src=""
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (130421 => 130422)
--- trunk/Source/WebCore/ChangeLog 2012-10-04 20:01:12 UTC (rev 130421)
+++ trunk/Source/WebCore/ChangeLog 2012-10-04 20:09:42 UTC (rev 130422)
@@ -1,3 +1,45 @@
+2012-10-04 Pravin D <[email protected]>
+
+ Layout broken after cloning and re-inserting a table with a misplaced <form>
+ https://bugs.webkit.org/show_bug.cgi?id=86746
+
+ Reviewed by Julien Chaffraix.
+
+ There is a concept of demotion for a <form> contained in a table. A <form> is demoted if its immediate parent
+ is either a <table>, table sections (tbody, etc) or a table row (tr). A renderer for such a <form> is created only
+ if its display is one of the table display types (TABLE, INLINE_TABLE, TABLE_FOOTER_GROUP, etc).
+ However when a <table> containing a demoted <form> is cloned, the <form> does not retain its demotion state and
+ results in the table getting improperly rendered.
+
+ Test: fast/table/form-with-non-table-display-inside-table-elements.html
+
+ * html/HTMLFormElement.cpp:
+ (WebCore::HTMLFormElement::copyNonAttributePropertiesFromElement):
+ Extended the virtual function for HTMLFormElement class specific implementation.
+ The function is used to copy any necessary state information(member variables) associated with
+ the <form> element being cloned to the current node.
+ For HTMLFormElement node the member variable can be classified into five groups based on the
+ information they hold:
+ 1) Variables containing information regarding <form> subtree and elements associated with it.
+ These get updated as and when an element is added to the <form> subtree.
+ 2) Variables containing <form> submit state information.
+ 3) Flag to hold information if reset() has been called.
+ 4) Flag(m_wasDemoted) that indicates whether the form is demoted or not, based on which it needs to
+ be handled differently during creation of its renderer.
+ This information is currently being updated only during the HTML tree construction phase.
+ 5) Flag(m_wasMalformed) to hold information if the <form> is malformed or not.
+
+ Variables of group (1) will be updated as and when elements are added to the <form> subtree. Whereas,
+ (2) and (3) hold instance specific information, thus copying them is not required. Also (5) is currently not
+ being used(not set by any code).
+
+ On the other hand, (4) is required to be copied during cloning as this information cannot be accessed
+ during the cloning process.
+
+ (WebCore):
+ * html/HTMLFormElement.h:
+ Added copyNonAttributePropertiesFromElement() declaration.
+
2012-10-04 Dean Jackson <[email protected]>
Attribute and Uniform variable names need translation in shader
Modified: trunk/Source/WebCore/html/HTMLFormElement.cpp (130421 => 130422)
--- trunk/Source/WebCore/html/HTMLFormElement.cpp 2012-10-04 20:01:12 UTC (rev 130421)
+++ trunk/Source/WebCore/html/HTMLFormElement.cpp 2012-10-04 20:09:42 UTC (rev 130422)
@@ -687,4 +687,10 @@
document()->formController()->restoreControlStateIn(*this);
}
+void HTMLFormElement::copyNonAttributePropertiesFromElement(const Element& source)
+{
+ m_wasDemoted = static_cast<const HTMLFormElement&>(source).m_wasDemoted;
+ HTMLElement::copyNonAttributePropertiesFromElement(source);
+}
+
} // namespace
Modified: trunk/Source/WebCore/html/HTMLFormElement.h (130421 => 130422)
--- trunk/Source/WebCore/html/HTMLFormElement.h 2012-10-04 20:01:12 UTC (rev 130421)
+++ trunk/Source/WebCore/html/HTMLFormElement.h 2012-10-04 20:09:42 UTC (rev 130422)
@@ -133,6 +133,8 @@
virtual bool shouldRegisterAsNamedItem() const OVERRIDE { return true; }
+ virtual void copyNonAttributePropertiesFromElement(const Element&) OVERRIDE;
+
void submit(Event*, bool activateSubmitButton, bool processingUserGesture, FormSubmissionTrigger);
unsigned formElementIndexWithFormAttribute(Element*, unsigned rangeStart, unsigned rangeEnd);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
