Title: [178354] releases/WebKitGTK/webkit-2.6
- Revision
- 178354
- Author
- [email protected]
- Date
- 2015-01-13 03:35:09 -0800 (Tue, 13 Jan 2015)
Log Message
Merge r177263 - REGRESSION(r160182): Fragment parser doesn't close a form element with a close tag
https://bugs.webkit.org/show_bug.cgi?id=139561
Reviewed by Darin Adler.
Source/WebCore:
The bug was caused by us not setting the form pointer in insertHTMLFormElement.
Since we already avoid associating a form inside HTMLConstructionSite::createHTMLElement,
we didn't need this code at all.
Fixed the bug by partially reverting r160182.
Test: fast/dom/dom-parse-close-form.html
* html/parser/HTMLConstructionSite.cpp:
(WebCore::HTMLConstructionSite::insertHTMLFormElement):
(WebCore::HTMLConstructionSite::insideTemplateElement): Deleted.
* html/parser/HTMLConstructionSite.h:
LayoutTests:
Added a regression test.
* fast/dom/dom-parse-close-form-expected.txt: Added.
* fast/dom/dom-parse-close-form.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.6/LayoutTests/ChangeLog (178353 => 178354)
--- releases/WebKitGTK/webkit-2.6/LayoutTests/ChangeLog 2015-01-13 11:28:39 UTC (rev 178353)
+++ releases/WebKitGTK/webkit-2.6/LayoutTests/ChangeLog 2015-01-13 11:35:09 UTC (rev 178354)
@@ -1,3 +1,15 @@
+2014-12-14 Ryosuke Niwa <[email protected]>
+
+ REGRESSION(r160182): Fragment parser doesn't close a form element with a close tag
+ https://bugs.webkit.org/show_bug.cgi?id=139561
+
+ Reviewed by Darin Adler.
+
+ Added a regression test.
+
+ * fast/dom/dom-parse-close-form-expected.txt: Added.
+ * fast/dom/dom-parse-close-form.html: Added.
+
2014-12-10 Dean Jackson <[email protected]>
InstancedArray crashes attempting to draw out of bounds
Added: releases/WebKitGTK/webkit-2.6/LayoutTests/fast/dom/dom-parse-close-form-expected.txt (0 => 178354)
--- releases/WebKitGTK/webkit-2.6/LayoutTests/fast/dom/dom-parse-close-form-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.6/LayoutTests/fast/dom/dom-parse-close-form-expected.txt 2015-01-13 11:35:09 UTC (rev 178354)
@@ -0,0 +1,10 @@
+This tests that DOMParser closes a form element when it sees its close tag.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS (new DOMParser()).parseFromString("<form></form>text", "text/html").body.innerHTML is "<form></form>text"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: releases/WebKitGTK/webkit-2.6/LayoutTests/fast/dom/dom-parse-close-form.html (0 => 178354)
--- releases/WebKitGTK/webkit-2.6/LayoutTests/fast/dom/dom-parse-close-form.html (rev 0)
+++ releases/WebKitGTK/webkit-2.6/LayoutTests/fast/dom/dom-parse-close-form.html 2015-01-13 11:35:09 UTC (rev 178354)
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src=""
+<script>
+
+description('This tests that DOMParser closes a form element when it sees its close tag.');
+
+shouldBeEqualToString('(new DOMParser()).parseFromString("<form></form>text", "text/html").body.innerHTML', '<form></form>text');
+
+var successfullyParsed = true;
+
+</script>
+<script src=""
+</body>
+</html>
Modified: releases/WebKitGTK/webkit-2.6/Source/WebCore/ChangeLog (178353 => 178354)
--- releases/WebKitGTK/webkit-2.6/Source/WebCore/ChangeLog 2015-01-13 11:28:39 UTC (rev 178353)
+++ releases/WebKitGTK/webkit-2.6/Source/WebCore/ChangeLog 2015-01-13 11:35:09 UTC (rev 178354)
@@ -1,3 +1,23 @@
+2014-12-14 Ryosuke Niwa <[email protected]>
+
+ REGRESSION(r160182): Fragment parser doesn't close a form element with a close tag
+ https://bugs.webkit.org/show_bug.cgi?id=139561
+
+ Reviewed by Darin Adler.
+
+ The bug was caused by us not setting the form pointer in insertHTMLFormElement.
+ Since we already avoid associating a form inside HTMLConstructionSite::createHTMLElement,
+ we didn't need this code at all.
+
+ Fixed the bug by partially reverting r160182.
+
+ Test: fast/dom/dom-parse-close-form.html
+
+ * html/parser/HTMLConstructionSite.cpp:
+ (WebCore::HTMLConstructionSite::insertHTMLFormElement):
+ (WebCore::HTMLConstructionSite::insideTemplateElement): Deleted.
+ * html/parser/HTMLConstructionSite.h:
+
2014-12-11 Alexey Proskuryakov <[email protected]>
Initialize m_ownsGeneratedFile when decoding a FormDataElement
Modified: releases/WebKitGTK/webkit-2.6/Source/WebCore/html/parser/HTMLConstructionSite.cpp (178353 => 178354)
--- releases/WebKitGTK/webkit-2.6/Source/WebCore/html/parser/HTMLConstructionSite.cpp 2015-01-13 11:28:39 UTC (rev 178353)
+++ releases/WebKitGTK/webkit-2.6/Source/WebCore/html/parser/HTMLConstructionSite.cpp 2015-01-13 11:35:09 UTC (rev 178354)
@@ -459,12 +459,10 @@
{
RefPtr<Element> element = createHTMLElement(token);
ASSERT(isHTMLFormElement(element.get()));
- RefPtr<HTMLFormElement> form = static_pointer_cast<HTMLFormElement>(element.release());
- if (!insideTemplateElement())
- m_form = form;
- form->setDemoted(isDemoted);
- attachLater(currentNode(), form);
- m_openElements.push(HTMLStackItem::create(form.release(), token));
+ m_form = static_pointer_cast<HTMLFormElement>(element.release());
+ m_form->setDemoted(isDemoted);
+ attachLater(currentNode(), m_form);
+ m_openElements.push(HTMLStackItem::create(m_form, token));
}
void HTMLConstructionSite::insertHTMLElement(AtomicHTMLToken* token)
@@ -624,11 +622,6 @@
return currentNode()->document();
}
-inline bool HTMLConstructionSite::insideTemplateElement()
-{
- return !ownerDocumentForCurrentNode().frame();
-}
-
PassRefPtr<Element> HTMLConstructionSite::createHTMLElement(AtomicHTMLToken* token)
{
QualifiedName tagName(nullAtom, token->name(), xhtmlNamespaceURI);
Modified: releases/WebKitGTK/webkit-2.6/Source/WebCore/html/parser/HTMLConstructionSite.h (178353 => 178354)
--- releases/WebKitGTK/webkit-2.6/Source/WebCore/html/parser/HTMLConstructionSite.h 2015-01-13 11:28:39 UTC (rev 178353)
+++ releases/WebKitGTK/webkit-2.6/Source/WebCore/html/parser/HTMLConstructionSite.h 2015-01-13 11:35:09 UTC (rev 178354)
@@ -144,7 +144,6 @@
HTMLStackItem* currentStackItem() const { return m_openElements.topStackItem(); }
HTMLStackItem* oneBelowTop() const { return m_openElements.oneBelowTop(); }
Document& ownerDocumentForCurrentNode();
- bool insideTemplateElement();
HTMLElementStack* openElements() const { return &m_openElements; }
HTMLFormattingElementList* activeFormattingElements() const { return &m_activeFormattingElements; }
bool currentIsRootNode() { return m_openElements.topNode() == m_openElements.rootNode(); }
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
