Changeset 140537 in webkit

Timestamp:

Jan 23, 2013 7:22:15 AM (11 years ago)

Author:

dominicc@chromium.org

Message:

REGRESSION(r140101): caused debug asserts in fast/forms/associated-element-crash.html and html5lib/run-template.html
​https://bugs.webkit.org/show_bug.cgi?id=107237

Patch by Rafael Weinstein <​rafaelw@chromium.org> on 2013-01-23
Reviewed by Adam Barth.

Source/WebCore:

No new tests needed.

When the parser foster-parent's a node out of a table context and the foster parent is a template element, set the Task.parent
to be the template element's content, rather than the element itself. This ensures the foster-parented node isn't errorenously
reparented.

• html/parser/HTMLConstructionSite.cpp:

(WebCore::HTMLConstructionSite::findFosterSite):

LayoutTests:

• platform/chromium/TestExpectations:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/platform/chromium/TestExpectations (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/parser/HTMLConstructionSite.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-01-23  Rafael Weinstein  <rafaelw@chromium.org>
+
+        REGRESSION(r140101): caused debug asserts in fast/forms/associated-element-crash.html and html5lib/run-template.html
+        https://bugs.webkit.org/show_bug.cgi?id=107237
+
+        Reviewed by Adam Barth.
+
+        * platform/chromium/TestExpectations:
+
 2013-01-23  Erik Arvidsson  <arv@chromium.org>
 

trunk/LayoutTests/platform/chromium/TestExpectations

@@ -4331 +4331 @@
 webkit.org/b/107316 [ Win Debug ] fast/inline/fixed-pos-moves-with-abspos-inline-parent.html [ Pass Failure ]
 
-webkit.org/b/107237 [ Debug ] html5lib/run-template.html [ Crash ]
-
 webkit.org/b/107328 http/tests/cache/cancel-multiple-post-xhrs.html [ Missing ]
 webkit.org/b/107341 [ Debug ] inspector/profiler/memory-instrumentation-cached-images.html [ Failure ]

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-01-23  Rafael Weinstein  <rafaelw@chromium.org>
+
+        REGRESSION(r140101): caused debug asserts in fast/forms/associated-element-crash.html and html5lib/run-template.html
+        https://bugs.webkit.org/show_bug.cgi?id=107237
+
+        Reviewed by Adam Barth.
+
+        No new tests needed.
+
+        When the parser foster-parent's a node out of a table context and the foster parent is a template element, set the Task.parent
+        to be the template element's content, rather than the element itself. This ensures the foster-parented node isn't errorenously
+        reparented.
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::findFosterSite):
+
 2013-01-23  Yury Semikhatsky  <yurys@chromium.org>
 

trunk/Source/WebCore/html/parser/HTMLConstructionSite.cpp

@@ -608 +608 @@
     HTMLElementStack::ElementRecord* lastTemplateElement = m_openElements.topmost(templateTag.localName());
     if (lastTemplateElement && !m_openElements.inTableScope(tableTag)) {
-        task.parent = lastTemplateElement->element();
-        return;
-    }
+        task.parent = toHTMLTemplateElement(lastTemplateElement->element())->content();
+        return;
+    }
+
 #endif