Title: [159607] trunk
- Revision
- 159607
- Author
- [email protected]
- Date
- 2013-11-20 22:10:31 -0800 (Wed, 20 Nov 2013)
Log Message
[HTML parser] reset insertion mode appropriate must check for "in select in table" mode
https://bugs.webkit.org/show_bug.cgi?id=123850
Reviewed by Antti Koivisto.
Source/WebCore:
Merge https://chromium.googlesource.com/chromium/blink/+/2cb7523df57dfb48111f6aa16b7138cd54024ba7
The HTML specification has been updated to detect encountering a template element inside of a select element,
which in turn is inside of a table element. In this case, the select element will cause the parser to be in
"InSelectInTable" mode. Thus when the template element closes, it should return to that mode.
The fix here is that resetInsertionModeAppropriately must continue looking up the stack if the first node is
select element to see whether the select element is inside of a table element.
See also: http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#reset-the-insertion-mode-appropriately
Test: html5lib/resources/template.dat
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately):
LayoutTests:
* html5lib/resources/template.dat:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (159606 => 159607)
--- trunk/LayoutTests/ChangeLog 2013-11-21 05:46:22 UTC (rev 159606)
+++ trunk/LayoutTests/ChangeLog 2013-11-21 06:10:31 UTC (rev 159607)
@@ -1,5 +1,14 @@
2013-11-20 Ryosuke Niwa <[email protected]>
+ [HTML parser] reset insertion mode appropriate must check for "in select in table" mode
+ https://bugs.webkit.org/show_bug.cgi?id=123850
+
+ Reviewed by Antti Koivisto.
+
+ * html5lib/resources/template.dat:
+
+2013-11-20 Ryosuke Niwa <[email protected]>
+
Clear TemplateContentDocumentFragment::m_host when HTMLTemplateElement is destroyed
https://bugs.webkit.org/show_bug.cgi?id=122806
Modified: trunk/LayoutTests/html5lib/resources/template.dat (159606 => 159607)
--- trunk/LayoutTests/html5lib/resources/template.dat 2013-11-21 05:46:22 UTC (rev 159606)
+++ trunk/LayoutTests/html5lib/resources/template.dat 2013-11-21 06:10:31 UTC (rev 159607)
@@ -1269,3 +1269,21 @@
| <template>
| content
| <span>
+
+#data
+<body><table><tr><td><select><template>Foo</template><caption>A</table>
+#errors
+#document
+| <html>
+| <head>
+| <body>
+| <table>
+| <tbody>
+| <tr>
+| <td>
+| <select>
+| <template>
+| content
+| "Foo"
+| <caption>
+| "A"
Modified: trunk/Source/WebCore/ChangeLog (159606 => 159607)
--- trunk/Source/WebCore/ChangeLog 2013-11-21 05:46:22 UTC (rev 159606)
+++ trunk/Source/WebCore/ChangeLog 2013-11-21 06:10:31 UTC (rev 159607)
@@ -1,3 +1,26 @@
+2013-11-20 Ryosuke Niwa <[email protected]>
+
+ [HTML parser] reset insertion mode appropriate must check for "in select in table" mode
+ https://bugs.webkit.org/show_bug.cgi?id=123850
+
+ Reviewed by Antti Koivisto.
+
+ Merge https://chromium.googlesource.com/chromium/blink/+/2cb7523df57dfb48111f6aa16b7138cd54024ba7
+
+ The HTML specification has been updated to detect encountering a template element inside of a select element,
+ which in turn is inside of a table element. In this case, the select element will cause the parser to be in
+ "InSelectInTable" mode. Thus when the template element closes, it should return to that mode.
+
+ The fix here is that resetInsertionModeAppropriately must continue looking up the stack if the first node is
+ select element to see whether the select element is inside of a table element.
+
+ See also: http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#reset-the-insertion-mode-appropriately
+
+ Test: html5lib/resources/template.dat
+
+ * html/parser/HTMLTreeBuilder.cpp:
+ (WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately):
+
2013-11-20 Mark Lam <[email protected]>
Build fix for last commit.
Modified: trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp (159606 => 159607)
--- trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2013-11-21 05:46:22 UTC (rev 159606)
+++ trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2013-11-21 06:10:31 UTC (rev 159607)
@@ -1641,6 +1641,16 @@
return setInsertionMode(m_templateInsertionModes.last());
#endif
if (item->hasTagName(selectTag)) {
+#if ENABLE(TEMPLATE_ELEMENT)
+ if (!last) {
+ while (item->node() != m_tree.openElements()->rootNode() && !item->hasTagName(templateTag)) {
+ nodeRecord = nodeRecord->next();
+ item = nodeRecord->stackItem();
+ if (isHTMLTableElement(item->node()))
+ return setInsertionMode(InSelectInTableMode);
+ }
+ }
+#endif
return setInsertionMode(InSelectMode);
}
if (item->hasTagName(tdTag) || item->hasTagName(thTag))
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
