Changeset 91048 in webkit

Timestamp:

Jul 14, 2011 9:36:29 PM (13 years ago)

Author:

bashi@chromium.org

Message:

<input form="x"> should not associate the input with any forms when there is no form with id="x"
​https://bugs.webkit.org/show_bug.cgi?id=64509

Source/WebCore:

Don't set form owner when a form associated element has the form attribute but there is no such form element.

Patch by Kenichi Ishibashi <​bashi@chromium.org> on 2011-07-14
Reviewed by Kent Tamura.

Test: fast/forms/form-attribute-nonexistence-form-id.html

• dom/Document.cpp:

(WebCore::Document::resetFormElementsOwner): Removed the argument which is no longer needed.

• dom/Document.h: Ditto.
• html/FormAssociatedElement.cpp:

(WebCore::FormAssociatedElement::insertedIntoTree): Resets m_form whenever the element has the form attribute.
(WebCore::FormAssociatedElement::resetFormOwner): Don't set m_form when there is no form element which has the given id.
(WebCore::FormAssociatedElement::formAttributeChanged): Removed the argument of resetFormOwner().

• html/FormAssociatedElement.h: Ditto.
• html/HTMLFormElement.cpp: Ditto.

(WebCore::HTMLFormElement::insertedIntoDocument):
(WebCore::HTMLFormElement::removedFromDocument):

LayoutTests:

Adds a test for checking input elements don't associate any form elements when they have the form attribute which points nonexistence form.
Fixes existing tests that contain unintended form attributes.

Patch by Kenichi Ishibashi <​bashi@chromium.org> on 2011-07-14
Reviewed by Kent Tamura.

• fast/forms/form-attribute-nonexistence-form-id-expected.txt: Added.
• fast/forms/form-attribute-nonexistence-form-id.html: Added.
• fast/forms/script-tests/form-attribute.js: Fixed unintended form attributes.
• fast/forms/script-tests/form-collection-elements-order.js: Ditto.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/forms/form-attribute-nonexistence-form-id-expected.txt (added)
• LayoutTests/fast/forms/form-attribute-nonexistence-form-id.html (added)
• LayoutTests/fast/forms/script-tests/form-attribute.js (modified) (1 diff)
• LayoutTests/fast/forms/script-tests/form-collection-elements-order.js (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Document.cpp (modified) (1 diff)
• Source/WebCore/dom/Document.h (modified) (1 diff)
• Source/WebCore/html/FormAssociatedElement.cpp (modified) (4 diffs)
• Source/WebCore/html/FormAssociatedElement.h (modified) (1 diff)
• Source/WebCore/html/HTMLFormElement.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-07-14  Kenichi Ishibashi  <bashi@chromium.org>
+
+        <input form="x"> should not associate the input with any forms when there is no  form with id="x"
+        https://bugs.webkit.org/show_bug.cgi?id=64509
+
+        Adds a test for checking input elements don't associate any form elements when they have the form attribute which points nonexistence form.
+        Fixes existing tests that contain unintended form attributes.
+
+        Reviewed by Kent Tamura.
+
+        * fast/forms/form-attribute-nonexistence-form-id-expected.txt: Added.
+        * fast/forms/form-attribute-nonexistence-form-id.html: Added.
+        * fast/forms/script-tests/form-attribute.js: Fixed unintended form attributes.
+        * fast/forms/script-tests/form-collection-elements-order.js: Ditto.
+
 2011-07-14  Kent Tamura  <tkent@chromium.org>
 

trunk/LayoutTests/fast/forms/script-tests/form-attribute.js

@@ -62 +62 @@
 container.innerHTML = '<form id=owner>' +
     '    <form>' +
-    '        <input id=inputElement1 name=victim form=owner/>' +
+    '        <input id=inputElement1 name=victim form=owner />' +
     '        <input id=inputElement2 name=victim />' +
-    '        <input id=inputElement3 name=victim form=owner/>' +
+    '        <input id=inputElement3 name=victim form=owner />' +
     '    </form>' +
     '</form>';

trunk/LayoutTests/fast/forms/script-tests/form-collection-elements-order.js

@@ -58 +58 @@
 container.innerHTML = '<button name=victim form=owner></button>' +
     '<fieldset name=victim form=owner>Test</fieldset>' +
-    '<input name=victim form=owner/>' +
+    '<input name=victim form=owner />' +
     '<keygen name=victim form=owner></keygen>' +
     '<form id=owner>' +

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-07-14  Kenichi Ishibashi  <bashi@chromium.org>
+
+        <input form="x"> should not associate the input with any forms when there is no  form with id="x"
+        https://bugs.webkit.org/show_bug.cgi?id=64509
+
+        Don't set form owner when a form associated element has the form attribute but there is no such form element.
+
+        Reviewed by Kent Tamura.
+
+        Test: fast/forms/form-attribute-nonexistence-form-id.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::resetFormElementsOwner): Removed the argument which is no longer needed.
+        * dom/Document.h: Ditto.
+        * html/FormAssociatedElement.cpp:
+        (WebCore::FormAssociatedElement::insertedIntoTree): Resets m_form whenever the element has the form attribute.
+        (WebCore::FormAssociatedElement::resetFormOwner): Don't set m_form when there is no form element which has the given id.
+        (WebCore::FormAssociatedElement::formAttributeChanged): Removed the argument of resetFormOwner().
+        * html/FormAssociatedElement.h: Ditto.
+        * html/HTMLFormElement.cpp: Ditto.
+        (WebCore::HTMLFormElement::insertedIntoDocument):
+        (WebCore::HTMLFormElement::removedFromDocument):
+
 2011-07-14  Kent Tamura  <tkent@chromium.org>
 

trunk/Source/WebCore/dom/Document.cpp

@@ -4374 +4374 @@
 }
 
-void Document::resetFormElementsOwner(HTMLFormElement* form)
+void Document::resetFormElementsOwner()
 {
     typedef FormAssociatedElementListHashSet::iterator Iterator;
     Iterator end = m_formElementsWithFormAttribute.end();
     for (Iterator it = m_formElementsWithFormAttribute.begin(); it != end; ++it)
-        (*it)->resetFormOwner(form);
+        (*it)->resetFormOwner();
 }
 

trunk/Source/WebCore/dom/Document.h

@@ -521 +521 @@
     void registerFormElementWithFormAttribute(FormAssociatedElement*);
     void unregisterFormElementWithFormAttribute(FormAssociatedElement*);
-    void resetFormElementsOwner(HTMLFormElement*);
+    void resetFormElementsOwner();
 
     FrameView* view() const; // can be NULL

trunk/Source/WebCore/html/FormAssociatedElement.cpp

@@ -78 +78 @@
     HTMLElement* element = toHTMLElement(this);
     if (element->fastHasAttribute(formAttr)) {
+        // Resets the form owner at first to make sure the element don't
+        // associate any form elements when there is no element which has
+        // the given ID.
+        if (m_form) {
+            m_form->removeFormElement(this);
+            m_form = 0;
+        }
         Element* formElement = element->treeScope()->getElementById(element->fastGetAttribute(formAttr));
         if (formElement && formElement->hasTagName(formTag)) {
-            if (m_form)
-                m_form->removeFormElement(this);
             m_form = static_cast<HTMLFormElement*>(formElement);
             m_form->registerFormElement(this);
         }
+        return;
     }
     if (!m_form) {
@@ -123 +129 @@
 }
 
-void FormAssociatedElement::resetFormOwner(HTMLFormElement* form)
+void FormAssociatedElement::resetFormOwner()
 {
     HTMLElement* element = toHTMLElement(this);
@@ -141 +147 @@
         if (firstElement && firstElement->hasTagName(formTag))
             m_form = static_cast<HTMLFormElement*>(firstElement);
-        else
-            m_form = form;
     } else
         m_form = element->findFormAncestor();
@@ -161 +165 @@
         element->document()->unregisterFormElementWithFormAttribute(this);
     } else
-        resetFormOwner(0);
+        resetFormOwner();
 }
 

trunk/Source/WebCore/html/FormAssociatedElement.h

@@ -56 +56 @@
     virtual void formDestroyed() { m_form = 0; }
 
-    void resetFormOwner(HTMLFormElement*);
+    void resetFormOwner();
 
 protected:

trunk/Source/WebCore/html/HTMLFormElement.cpp

@@ -139 +139 @@
 
     if (hasID())
-        document()->resetFormElementsOwner(this);
+        document()->resetFormElementsOwner();
 }
 
@@ -150 +150 @@
 
     if (hasID())
-        document()->resetFormElementsOwner(0);
+        document()->resetFormElementsOwner();
 }