- Revision
- 200108
- Author
- [email protected]
- Date
- 2016-04-26 15:07:27 -0700 (Tue, 26 Apr 2016)
Log Message
ASSERTION FAILED: m_templateInsertionModes.isEmpty() in WebCore::HTMLTreeBuilder::finished
https://bugs.webkit.org/show_bug.cgi?id=143519
Reviewed by Darin Adler.
LayoutTests/imported/w3c:
Rebaselined the tests.
* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant-expected.txt:
* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset-expected.txt:
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset-expected.txt:
Source/WebCore:
The assertion failure was caused by our parser inconsistently following the spec. Fixed it by making our HTML parser
match the latest HTML5 specification. See inline comments below.
Tests: fast/dom/HTMLTemplateElement/parsing-template-with-frameset.html
html5lib/generated/run-template-data.html
html5lib/generated/run-template-write.html
imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant.html
imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset.html
imported/w3c/web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset.html
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::processStartTagForInBody): When parsing a template element for 'in body' insertion mode,
we process the token using the rules for 'in head' insertion mode, which sets the frameset-ok flag to "not ok".
In addition, 'in template' insertion mode should not special case a start tag whose tag name is "frame". Instead,
fallback to using 'in body' insertion mode.
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody
(WebCore::HTMLTreeBuilder::processStartTag): 'in frameset' insertion mode should not special case a start tag whose
tag name is "template": https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inframeset
(WebCore::HTMLTreeBuilder::processEndTag): Ditto for an end tag whose name is "template".
(WebCore::HTMLTreeBuilder::processStartTagForInHead): When parsing a template element in 'in head' inserting mode,
we set the frameset-ok flag to "not ok": https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inhead
LayoutTests:
Rebaselined the html5lib tests (now passes all the test cases!) and added a regression test for an assertion.
* fast/dom/HTMLTemplateElement/parsing-template-with-frameset-expected.txt: Added.
* fast/dom/HTMLTemplateElement/parsing-template-with-frameset.html: Added.
* html5lib/generated/run-template-data-expected.txt:
* html5lib/generated/run-template-write-expected.txt:
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (200107 => 200108)
--- trunk/LayoutTests/ChangeLog 2016-04-26 21:47:20 UTC (rev 200107)
+++ trunk/LayoutTests/ChangeLog 2016-04-26 22:07:27 UTC (rev 200108)
@@ -1,3 +1,17 @@
+2016-04-26 Ryosuke Niwa <[email protected]>
+
+ ASSERTION FAILED: m_templateInsertionModes.isEmpty() in WebCore::HTMLTreeBuilder::finished
+ https://bugs.webkit.org/show_bug.cgi?id=143519
+
+ Reviewed by Darin Adler.
+
+ Rebaselined the html5lib tests (now passes all the test cases!) and added a regression test for an assertion.
+
+ * fast/dom/HTMLTemplateElement/parsing-template-with-frameset-expected.txt: Added.
+ * fast/dom/HTMLTemplateElement/parsing-template-with-frameset.html: Added.
+ * html5lib/generated/run-template-data-expected.txt:
+ * html5lib/generated/run-template-write-expected.txt:
+
2016-04-26 Skachkov Oleksandr <[email protected]>
calling super() a second time in a constructor should throw
Added: trunk/LayoutTests/fast/dom/HTMLTemplateElement/parsing-template-with-frameset-expected.txt (0 => 200108)
--- trunk/LayoutTests/fast/dom/HTMLTemplateElement/parsing-template-with-frameset-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/HTMLTemplateElement/parsing-template-with-frameset-expected.txt 2016-04-26 22:07:27 UTC (rev 200108)
@@ -0,0 +1 @@
+This tests parsing a template element with a frameset element. WebKit should not hit an assertion.
Added: trunk/LayoutTests/fast/dom/HTMLTemplateElement/parsing-template-with-frameset.html (0 => 200108)
--- trunk/LayoutTests/fast/dom/HTMLTemplateElement/parsing-template-with-frameset.html (rev 0)
+++ trunk/LayoutTests/fast/dom/HTMLTemplateElement/parsing-template-with-frameset.html 2016-04-26 22:07:27 UTC (rev 200108)
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<ins></ins>
+<template>
+ <frameset></frameset>
+</template>
+<script>
+
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+document.write('This tests parsing a template element with a frameset element. WebKit should not hit an assertion.');
+
+</script>
Modified: trunk/LayoutTests/html5lib/generated/run-template-data-expected.txt (200107 => 200108)
--- trunk/LayoutTests/html5lib/generated/run-template-data-expected.txt 2016-04-26 21:47:20 UTC (rev 200107)
+++ trunk/LayoutTests/html5lib/generated/run-template-data-expected.txt 2016-04-26 22:07:27 UTC (rev 200108)
@@ -1,76 +1 @@
-../resources/template.dat:
-40
-41
-68
-94
-
-Test 40 of 108 in ../resources/template.dat failed. Input:
-<frameset><template><frame></frame></template></frameset>
-Got:
-| <html>
-| <head>
-| <frameset>
-| <template>
-| content
-| <frame>
-Expected:
-| <html>
-| <head>
-| <frameset>
-| <frame>
-
-Test 41 of 108 in ../resources/template.dat failed. Input:
-<template><frame></frame></frameset><frame></frame></template>
-Got:
-| <html>
-| <head>
-| <template>
-| content
-| <frame>
-| <frame>
-| <body>
-Expected:
-| <html>
-| <head>
-| <template>
-| content
-| <body>
-
-Test 68 of 108 in ../resources/template.dat failed. Input:
-<html a=b><template><frame></frame><html b=c><frame></frame></template>
-Got:
-| <html>
-| a="b"
-| <head>
-| <template>
-| content
-| <frame>
-| <frame>
-| <body>
-Expected:
-| <html>
-| a="b"
-| <head>
-| <template>
-| content
-| <body>
-
-Test 94 of 108 in ../resources/template.dat failed. Input:
-<template><template><frame>
-Got:
-| <html>
-| <head>
-| <template>
-| content
-| <template>
-| content
-| <frame>
-| <body>
-Expected:
-| <html>
-| <head>
-| <template>
-| content
-| <template>
-| content
-| <body>
+../resources/template.dat: PASS
Modified: trunk/LayoutTests/html5lib/generated/run-template-write-expected.txt (200107 => 200108)
--- trunk/LayoutTests/html5lib/generated/run-template-write-expected.txt 2016-04-26 21:47:20 UTC (rev 200107)
+++ trunk/LayoutTests/html5lib/generated/run-template-write-expected.txt 2016-04-26 22:07:27 UTC (rev 200108)
@@ -1,76 +1 @@
-../resources/template.dat:
-40
-41
-68
-94
-
-Test 40 of 108 in ../resources/template.dat failed. Input:
-<frameset><template><frame></frame></template></frameset>
-Got:
-| <html>
-| <head>
-| <frameset>
-| <template>
-| content
-| <frame>
-Expected:
-| <html>
-| <head>
-| <frameset>
-| <frame>
-
-Test 41 of 108 in ../resources/template.dat failed. Input:
-<template><frame></frame></frameset><frame></frame></template>
-Got:
-| <html>
-| <head>
-| <template>
-| content
-| <frame>
-| <frame>
-| <body>
-Expected:
-| <html>
-| <head>
-| <template>
-| content
-| <body>
-
-Test 68 of 108 in ../resources/template.dat failed. Input:
-<html a=b><template><frame></frame><html b=c><frame></frame></template>
-Got:
-| <html>
-| a="b"
-| <head>
-| <template>
-| content
-| <frame>
-| <frame>
-| <body>
-Expected:
-| <html>
-| a="b"
-| <head>
-| <template>
-| content
-| <body>
-
-Test 94 of 108 in ../resources/template.dat failed. Input:
-<template><template><frame>
-Got:
-| <html>
-| <head>
-| <template>
-| content
-| <template>
-| content
-| <frame>
-| <body>
-Expected:
-| <html>
-| <head>
-| <template>
-| content
-| <template>
-| content
-| <body>
+../resources/template.dat: PASS
Modified: trunk/LayoutTests/imported/w3c/ChangeLog (200107 => 200108)
--- trunk/LayoutTests/imported/w3c/ChangeLog 2016-04-26 21:47:20 UTC (rev 200107)
+++ trunk/LayoutTests/imported/w3c/ChangeLog 2016-04-26 22:07:27 UTC (rev 200108)
@@ -1,3 +1,16 @@
+2016-04-26 Ryosuke Niwa <[email protected]>
+
+ ASSERTION FAILED: m_templateInsertionModes.isEmpty() in WebCore::HTMLTreeBuilder::finished
+ https://bugs.webkit.org/show_bug.cgi?id=143519
+
+ Reviewed by Darin Adler.
+
+ Rebaselined the tests.
+
+ * web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant-expected.txt:
+ * web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset-expected.txt:
+ * web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset-expected.txt:
+
2016-04-25 Ryosuke Niwa <[email protected]>
Update template element tests
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant-expected.txt (200107 => 200108)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant-expected.txt 2016-04-26 21:47:20 UTC (rev 200107)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant-expected.txt 2016-04-26 22:07:27 UTC (rev 200108)
@@ -1,10 +1,10 @@
PASS Template element as a descendant of the BODY element. Template element is created by innerHTML
PASS Template element as a descendant of the HEAD element. Template element is created by innerHTML
-PASS Template element as a descendant of the FRAMESET element. Template element is created by innerHTML
+FAIL Template element as a descendant of the FRAMESET element. Template element is created by innerHTML assert_not_equals: Template element should be a descendant of the FRAMESET element got disallowed value null
PASS Template element as an indirect descendant of the BODY element. Template element is created by innerHTML
PASS Template element as an indirect descendant of the HEAD element. Template element is created by innerHTML
-PASS Template element as an indirect descendant of the FRAMESET element. Template element is created by innerHTML
+FAIL Template element as an indirect descendant of the FRAMESET element. Template element is created by innerHTML assert_not_equals: Template element should be a descendant of the FRAMESET element got disallowed value null
PASS Template element as a descendant of the BODY element. Template element is appended by appendChild()
PASS Template element as a descendant of the HEAD element. Template element is appended by appendChild()
PASS Template element as a descendant of the FRAMESET element. Template element is appended by appendChild()
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset-expected.txt (200107 => 200108)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset-expected.txt 2016-04-26 21:47:20 UTC (rev 200107)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset-expected.txt 2016-04-26 22:07:27 UTC (rev 200108)
@@ -1,7 +1,5 @@
-FAIL Template element as a descendant of the frameset element. Test loading from a file assert_equals: Template element should not be a descendant of the frameset element expected null but got Element node <template>
- <div>Hello, template</div>
- </templ...
-FAIL Template element as a descendant of the frameset element. Test template element is assigned to frameset's innerHTML) assert_equals: Template element should not be a descendant of the frameset element expected null but got Element node <template>some text</template>
-FAIL Template element as a descendant of the frameset element. Test template element appended to frameset by appendChild() assert_equals: Template element should be a descendant of the frameset element expected 1 but got 2
+PASS Template element as a descendant of the frameset element. Test loading from a file
+PASS Template element as a descendant of the frameset element. Test template element is assigned to frameset's innerHTML)
+PASS Template element as a descendant of the frameset element. Test template element appended to frameset by appendChild()
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset-expected.txt (200107 => 200108)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset-expected.txt 2016-04-26 21:47:20 UTC (rev 200107)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset-expected.txt 2016-04-26 22:07:27 UTC (rev 200108)
@@ -1,3 +1,3 @@
-FAIL <template> tag should be ignored in "in frameset" insertion mode assert_equals: Wrong number of frameset children elements expected 0 but got 1
+PASS <template> tag should be ignored in "in frameset" insertion mode
Modified: trunk/Source/WebCore/ChangeLog (200107 => 200108)
--- trunk/Source/WebCore/ChangeLog 2016-04-26 21:47:20 UTC (rev 200107)
+++ trunk/Source/WebCore/ChangeLog 2016-04-26 22:07:27 UTC (rev 200108)
@@ -1,3 +1,32 @@
+2016-04-26 Ryosuke Niwa <[email protected]>
+
+ ASSERTION FAILED: m_templateInsertionModes.isEmpty() in WebCore::HTMLTreeBuilder::finished
+ https://bugs.webkit.org/show_bug.cgi?id=143519
+
+ Reviewed by Darin Adler.
+
+ The assertion failure was caused by our parser inconsistently following the spec. Fixed it by making our HTML parser
+ match the latest HTML5 specification. See inline comments below.
+
+ Tests: fast/dom/HTMLTemplateElement/parsing-template-with-frameset.html
+ html5lib/generated/run-template-data.html
+ html5lib/generated/run-template-write.html
+ imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant.html
+ imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset.html
+ imported/w3c/web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset.html
+
+ * html/parser/HTMLTreeBuilder.cpp:
+ (WebCore::HTMLTreeBuilder::processStartTagForInBody): When parsing a template element for 'in body' insertion mode,
+ we process the token using the rules for 'in head' insertion mode, which sets the frameset-ok flag to "not ok".
+ In addition, 'in template' insertion mode should not special case a start tag whose tag name is "frame". Instead,
+ fallback to using 'in body' insertion mode.
+ https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody
+ (WebCore::HTMLTreeBuilder::processStartTag): 'in frameset' insertion mode should not special case a start tag whose
+ tag name is "template": https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inframeset
+ (WebCore::HTMLTreeBuilder::processEndTag): Ditto for an end tag whose name is "template".
+ (WebCore::HTMLTreeBuilder::processStartTagForInHead): When parsing a template element in 'in head' inserting mode,
+ we set the frameset-ok flag to "not ok": https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inhead
+
2016-04-26 Filip Pizlo <[email protected]>
WebCore on Mac ignores the user's preferred region (country) while getting the language
Modified: trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp (200107 => 200108)
--- trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2016-04-26 21:47:20 UTC (rev 200107)
+++ trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2016-04-26 22:07:27 UTC (rev 200108)
@@ -896,6 +896,7 @@
return;
}
if (token.name() == templateTag) {
+ m_framesetOk = false;
processTemplateStartTag(token);
return;
}
@@ -1288,10 +1289,6 @@
processStartTagForInHead(token);
return;
}
- if (token.name() == templateTag) {
- processTemplateStartTag(token);
- return;
- }
parseError(token);
break;
case InsertionMode::AfterFrameset:
@@ -1393,9 +1390,7 @@
}
InsertionMode insertionMode = InsertionMode::TemplateContents;
- if (token.name() == frameTag)
- insertionMode = InsertionMode::InFrameset;
- else if (token.name() == colTag)
+ if (token.name() == colTag)
insertionMode = InsertionMode::InColumnGroup;
else if (isCaptionColOrColgroupTag(token.name()) || isTableBodyContextTag(token.name()))
insertionMode = InsertionMode::InTable;
@@ -2137,10 +2132,6 @@
m_insertionMode = InsertionMode::AfterFrameset;
return;
}
- if (token.name() == templateTag) {
- processTemplateEndTag(token);
- return;
- }
break;
case InsertionMode::AfterFrameset:
if (token.name() == htmlTag) {
@@ -2679,6 +2670,7 @@
return true;
}
if (token.name() == templateTag) {
+ m_framesetOk = false;
processTemplateStartTag(token);
return true;
}
