Changeset 145464 in webkit

Timestamp:

Mar 11, 2013 7:09:50 PM (11 years ago)

Author:

abarth@webkit.org

Message:

Make BackgroundHTMLParser work with doc.writes that enter or leave foreign content
​https://bugs.webkit.org/show_bug.cgi?id=109764

Reviewed by Eric Seidel.

Source/WebCore:

Previously, we were not reseting the state of the
HTMLTreeBuilderSimulator when we failed speculative parsing. This had a
number of observable consequences, including not parsing CDATA sections
correctly when document.write caused us to enter foreign content.

Test: fast/parser/document-write-svg-cdata.html

• html/parser/BackgroundHTMLParser.cpp:

(WebCore::BackgroundHTMLParser::BackgroundHTMLParser):
(WebCore::BackgroundHTMLParser::resumeFrom):
(WebCore::BackgroundHTMLParser::pumpTokenizer):
(WebCore::BackgroundHTMLParser::sendTokensToMainThread):

• html/parser/BackgroundHTMLParser.h:

(Checkpoint):
(BackgroundHTMLParser):

• html/parser/HTMLDocumentParser.cpp:

(WebCore::HTMLDocumentParser::validateSpeculations):
(WebCore::HTMLDocumentParser::didFailSpeculation):

• html/parser/HTMLDocumentParser.h:

(ParsedChunk):

• html/parser/HTMLElementStack.h:

(WebCore::HTMLElementStack::ElementRecord::namespaceURI):

• html/parser/HTMLTreeBuilder.h:

(WebCore::HTMLTreeBuilder::options):
(WebCore::HTMLTreeBuilder::openElements):
(HTMLTreeBuilder):

• html/parser/HTMLTreeBuilderSimulator.cpp:

(WebCore::HTMLTreeBuilderSimulator::stateFor):
(WebCore):

• html/parser/HTMLTreeBuilderSimulator.h:

(WebCore):
(WebCore::HTMLTreeBuilderSimulator::state):
(WebCore::HTMLTreeBuilderSimulator::setState):
(HTMLTreeBuilderSimulator):

LayoutTests:

• fast/parser/document-write-svg-cdata-expected.txt: Added.
• fast/parser/document-write-svg-cdata.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/parser/document-write-svg-cdata-expected.txt (added)
• LayoutTests/fast/parser/document-write-svg-cdata.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/parser/BackgroundHTMLParser.cpp (modified) (3 diffs)
• Source/WebCore/html/parser/BackgroundHTMLParser.h (modified) (2 diffs)
• Source/WebCore/html/parser/HTMLDocumentParser.cpp (modified) (2 diffs)
• Source/WebCore/html/parser/HTMLDocumentParser.h (modified) (2 diffs)
• Source/WebCore/html/parser/HTMLElementStack.h (modified) (1 diff)
• Source/WebCore/html/parser/HTMLTreeBuilder.h (modified) (1 diff)
• Source/WebCore/html/parser/HTMLTreeBuilderSimulator.cpp (modified) (2 diffs)
• Source/WebCore/html/parser/HTMLTreeBuilderSimulator.h (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-03-11  Adam Barth  <abarth@webkit.org>
+
+        Make BackgroundHTMLParser work with doc.writes that enter or leave foreign content
+        https://bugs.webkit.org/show_bug.cgi?id=109764
+
+        Reviewed by Eric Seidel.
+
+        * fast/parser/document-write-svg-cdata-expected.txt: Added.
+        * fast/parser/document-write-svg-cdata.html: Added.
+
 2013-03-11  Yuki Sekiguchi  <yuki.sekiguchi@access-company.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-03-11  Adam Barth  <abarth@webkit.org>
+
+        Make BackgroundHTMLParser work with doc.writes that enter or leave foreign content
+        https://bugs.webkit.org/show_bug.cgi?id=109764
+
+        Reviewed by Eric Seidel.
+
+        Previously, we were not reseting the state of the
+        HTMLTreeBuilderSimulator when we failed speculative parsing. This had a
+        number of observable consequences, including not parsing CDATA sections
+        correctly when document.write caused us to enter foreign content.
+
+        Test: fast/parser/document-write-svg-cdata.html
+
+        * html/parser/BackgroundHTMLParser.cpp:
+        (WebCore::BackgroundHTMLParser::BackgroundHTMLParser):
+        (WebCore::BackgroundHTMLParser::resumeFrom):
+        (WebCore::BackgroundHTMLParser::pumpTokenizer):
+        (WebCore::BackgroundHTMLParser::sendTokensToMainThread):
+        * html/parser/BackgroundHTMLParser.h:
+        (Checkpoint):
+        (BackgroundHTMLParser):
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::validateSpeculations):
+        (WebCore::HTMLDocumentParser::didFailSpeculation):
+        * html/parser/HTMLDocumentParser.h:
+        (ParsedChunk):
+        * html/parser/HTMLElementStack.h:
+        (WebCore::HTMLElementStack::ElementRecord::namespaceURI):
+        * html/parser/HTMLTreeBuilder.h:
+        (WebCore::HTMLTreeBuilder::options):
+        (WebCore::HTMLTreeBuilder::openElements):
+        (HTMLTreeBuilder):
+        * html/parser/HTMLTreeBuilderSimulator.cpp:
+        (WebCore::HTMLTreeBuilderSimulator::stateFor):
+        (WebCore):
+        * html/parser/HTMLTreeBuilderSimulator.h:
+        (WebCore):
+        (WebCore::HTMLTreeBuilderSimulator::state):
+        (WebCore::HTMLTreeBuilderSimulator::setState):
+        (HTMLTreeBuilderSimulator):
+
 2013-03-11  Abhishek Arya  <inferno@chromium.org>
 

trunk/Source/WebCore/html/parser/BackgroundHTMLParser.cpp

@@ -66 +66 @@
 BackgroundHTMLParser::BackgroundHTMLParser(PassRefPtr<WeakReference<BackgroundHTMLParser> > reference, PassOwnPtr<Configuration> config)
     : m_weakFactory(reference, this)
-    , m_treeBuilderSimulator(config->options)
     , m_token(adoptPtr(new HTMLToken))
     , m_tokenizer(HTMLTokenizer::create(config->options))
+    , m_treeBuilderSimulator(config->options)
     , m_options(config->options)
     , m_parser(config->parser)
@@ -89 +89 @@
     m_token = checkpoint->token.release();
     m_tokenizer = checkpoint->tokenizer.release();
+    m_treeBuilderSimulator.setState(checkpoint->treeBuilderState);
     m_input.rewindTo(checkpoint->inputCheckpoint, checkpoint->unparsedInput);
     m_preloadScanner->rewindTo(checkpoint->preloadScannerCheckpoint);
@@ -175 +176 @@
     chunk->xssInfos.swap(m_pendingXSSInfos);
     chunk->tokenizerState = m_tokenizer->state();
+    chunk->treeBuilderState = m_treeBuilderSimulator.state();
     chunk->inputCheckpoint = m_input.createCheckpoint();
     chunk->preloadScannerCheckpoint = m_preloadScanner->createCheckpoint();

trunk/Source/WebCore/html/parser/BackgroundHTMLParser.h

@@ -68 +68 @@
         OwnPtr<HTMLToken> token;
         OwnPtr<HTMLTokenizer> tokenizer;
+        HTMLTreeBuilderSimulator::State treeBuilderState;
         HTMLInputCheckpoint inputCheckpoint;
         TokenPreloadScannerCheckpoint preloadScannerCheckpoint;
@@ -91 +92 @@
     BackgroundHTMLInputStream m_input;
     HTMLSourceTracker m_sourceTracker;
-    HTMLTreeBuilderSimulator m_treeBuilderSimulator;
     OwnPtr<HTMLToken> m_token;
     OwnPtr<HTMLTokenizer> m_tokenizer;
+    HTMLTreeBuilderSimulator m_treeBuilderSimulator;
     HTMLParserOptions m_options;
     WeakPtr<HTMLDocumentParser> m_parser;

trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp

@@ -355 +355 @@
     if (m_currentChunk->tokenizerState == HTMLTokenizer::DataState
         && tokenizer->state() == HTMLTokenizer::DataState
-        && m_input.current().isEmpty()) {
+        && m_input.current().isEmpty()
+        && m_currentChunk->treeBuilderState == HTMLTreeBuilderSimulator::stateFor(m_treeBuilder.get())) {
         ASSERT(token->isUninitialized());
         return;
@@ -372 +373 @@
     checkpoint->token = token;
     checkpoint->tokenizer = tokenizer;
+    checkpoint->treeBuilderState = HTMLTreeBuilderSimulator::stateFor(m_treeBuilder.get());
     checkpoint->inputCheckpoint = m_currentChunk->inputCheckpoint;
     checkpoint->preloadScannerCheckpoint = m_currentChunk->preloadScannerCheckpoint;

trunk/Source/WebCore/html/parser/HTMLDocumentParser.h

@@ -38 +38 @@
 #include "HTMLToken.h"
 #include "HTMLTokenizer.h"
+#include "HTMLTreeBuilderSimulator.h"
 #include "ScriptableDocumentParser.h"
 #include "SegmentedString.h"
@@ -92 +93 @@
         XSSInfoStream xssInfos;
         HTMLTokenizer::State tokenizerState;
+        HTMLTreeBuilderSimulator::State treeBuilderState;
         HTMLInputCheckpoint inputCheckpoint;
         TokenPreloadScannerCheckpoint preloadScannerCheckpoint;

trunk/Source/WebCore/html/parser/HTMLElementStack.h

@@ -58 +58 @@
         Element* element() const { return m_item->element(); }
         ContainerNode* node() const { return m_item->node(); }
+        const AtomicString& namespaceURI() const { return m_item->namespaceURI(); }
         PassRefPtr<HTMLStackItem> stackItem() const { return m_item; }
         void replaceElement(PassRefPtr<HTMLStackItem>);

trunk/Source/WebCore/html/parser/HTMLTreeBuilder.h

@@ -68 +68 @@
     }
     ~HTMLTreeBuilder();
+
+    const HTMLElementStack* openElements() const { return m_tree.openElements(); }
 
     bool isParsingFragment() const { return !!m_fragmentContext.fragment(); }

trunk/Source/WebCore/html/parser/HTMLTreeBuilderSimulator.cpp

@@ -34 +34 @@
 #include "HTMLParserIdioms.h"
 #include "HTMLTokenizer.h"
+#include "HTMLTreeBuilder.h"
 #include "MathMLNames.h"
 #include "SVGNames.h"
@@ -118 +119 @@
 }
 
+HTMLTreeBuilderSimulator::State HTMLTreeBuilderSimulator::stateFor(HTMLTreeBuilder* treeBuilder)
+{
+    ASSERT(isMainThread());
+    State namespaceStack;
+    for (HTMLElementStack::ElementRecord* record = treeBuilder->openElements()->topRecord(); record; record = record->next()) {
+        Namespace currentNamespace = HTML;
+        if (record->namespaceURI() == SVGNames::svgNamespaceURI)
+            currentNamespace = SVG;
+        else if (record->namespaceURI() == MathMLNames::mathmlNamespaceURI)
+            currentNamespace = MathML;
+
+        if (namespaceStack.isEmpty() || namespaceStack.last() != currentNamespace)
+            namespaceStack.append(currentNamespace);
+    }
+    namespaceStack.reverse();
+    return namespaceStack;
+}
+
 bool HTMLTreeBuilderSimulator::simulate(const CompactHTMLToken& token, HTMLTokenizer* tokenizer)
 {

trunk/Source/WebCore/html/parser/HTMLTreeBuilderSimulator.h

@@ -30 +30 @@
 
 #include "HTMLParserOptions.h"
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
@@ -36 +37 @@
 class CompactHTMLToken;
 class HTMLTokenizer;
+class HTMLTreeBuilder;
 
 class HTMLTreeBuilderSimulator {
     WTF_MAKE_FAST_ALLOCATED;
-public:
-    explicit HTMLTreeBuilderSimulator(const HTMLParserOptions&);
-    bool simulate(const CompactHTMLToken&, HTMLTokenizer*);
-
 private:
     enum Namespace {
@@ -50 +48 @@
     };
 
+public:
+    typedef Vector<Namespace, 1> State;
+
+    explicit HTMLTreeBuilderSimulator(const HTMLParserOptions&);
+
+    static State stateFor(HTMLTreeBuilder*);
+
+    const State& state() const { return m_namespaceStack; }
+    void setState(const State& state) { m_namespaceStack = state; }
+
+    bool simulate(const CompactHTMLToken&, HTMLTokenizer*);
+
+private:
+    explicit HTMLTreeBuilderSimulator(HTMLTreeBuilder*);
+
     bool inForeignContent() const { return m_namespaceStack.last() != HTML; }
 
     HTMLParserOptions m_options;
-    Vector<Namespace, 1> m_namespaceStack;
+    State m_namespaceStack;
 };