Changeset 159618 in webkit

Timestamp:

Nov 21, 2013 5:43:34 AM (10 years ago)

Author:

rniwa@webkit.org

Message:

HTML parser should not associate elements inside templates with forms
​https://bugs.webkit.org/show_bug.cgi?id=117779

Reviewed by Antti Koivisto.

Source/WebCore:

Merge ​https://chromium.googlesource.com/chromium/blink/+/45aadf7ee7ee010327eb692066cf013315ef3ed7

When parsing <form><template><input>, the previous behavior was to associate the <input> with the <form>,
even though they're not in the same tree (or even the same document).

This patch changes that by checking, prior to creating a form control element, whether the element to be
created lives in a document with a browsing context.

We don't update m_form as needed to faithfully match the HTML5 specification's form element pointer
​http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#form-element-pointer
and its algorithm for creating and inserting nodes:
​http://www.whatwg.org/specs/web-apps/current-work/multipage/tree-construction.html#creating-and-inserting-nodes

While this leaves isindex's reference to form element pointer stale:
​http://www.whatwg.org/specs/web-apps/current-work/multipage/tree-construction.html#isindex
The HTML5 specification matches the behaviors of Chrome and Firefox so we leave it as is.

Test: fast/dom/HTMLTemplateElement/no-form-association.html

• html/parser/HTMLConstructionSite.cpp:

(WebCore::HTMLConstructionSite::createHTMLElement):

LayoutTests:

• fast/dom/HTMLTemplateElement/no-form-association-expected.txt: Added.
• fast/dom/HTMLTemplateElement/no-form-association.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/HTMLTemplateElement/no-form-association-expected.txt (added)
• LayoutTests/fast/dom/HTMLTemplateElement/no-form-association.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/parser/HTMLConstructionSite.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-11-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        HTML parser should not associate elements inside templates with forms
+        https://bugs.webkit.org/show_bug.cgi?id=117779
+
+        Reviewed by Antti Koivisto.
+
+        * fast/dom/HTMLTemplateElement/no-form-association-expected.txt: Added.
+        * fast/dom/HTMLTemplateElement/no-form-association.html: Added.
+
 2013-11-20  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-11-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        HTML parser should not associate elements inside templates with forms
+        https://bugs.webkit.org/show_bug.cgi?id=117779
+
+        Reviewed by Antti Koivisto.
+
+        Merge https://chromium.googlesource.com/chromium/blink/+/45aadf7ee7ee010327eb692066cf013315ef3ed7
+
+        When parsing <form><template><input>, the previous behavior was to associate the <input> with the <form>,
+        even though they're not in the same tree (or even the same document).
+
+        This patch changes that by checking, prior to creating a form control element, whether the element to be
+        created lives in a document with a browsing context.
+
+        We don't update m_form as needed to faithfully match the HTML5 specification's form element pointer
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#form-element-pointer
+        and its algorithm for creating and inserting nodes:
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/tree-construction.html#creating-and-inserting-nodes
+
+        While this leaves isindex's reference to form element pointer stale:
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/tree-construction.html#isindex
+        The HTML5 specification matches the behaviors of Chrome and Firefox so we leave it as is.
+
+        Test: fast/dom/HTMLTemplateElement/no-form-association.html
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::createHTMLElement):
+
 2013-11-21  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebCore/html/parser/HTMLConstructionSite.cpp

@@ -544 +544 @@
     // have to pass the current form element.  We should rework form association
     // to occur after construction to allow better code sharing here.
-    RefPtr<Element> element = HTMLElementFactory::createElement(tagName, ownerDocumentForCurrentNode(), form(), true);
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/tree-construction.html#create-an-element-for-the-token
+    Document& ownerDocument = ownerDocumentForCurrentNode();
+    bool openElementsContainTemplateElement = !ownerDocument.frame();
+    RefPtr<Element> element = HTMLElementFactory::createElement(tagName, ownerDocument, openElementsContainTemplateElement ? nullptr : form(), true);
     setAttributes(element.get(), token, m_parserContentPolicy);
     ASSERT(element->isHTMLElement());