[HTMLTemplateElement] prevent the parser from removing nodes from the content when...
authorrafaelw@chromium.org <rafaelw@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 30 Jan 2013 23:11:52 +0000 (23:11 +0000)
committerrafaelw@chromium.org <rafaelw@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 30 Jan 2013 23:11:52 +0000 (23:11 +0000)
https://bugs.webkit.org/show_bug.cgi?id=108377

Reviewed by Adam Barth.

Source/WebCore:

https://dvcs.w3.org/hg/webcomponents/raw-file/50ce1f368c1a/spec/templates/index.html#in-body-addition

callTheAdoptionAgency now appends to the template's content when it previously would have appended to the template element itself.

New test added to html5lib.

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::parserInsertBefore):
(WebCore::ContainerNode::parserAppendChild):
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::callTheAdoptionAgency):

LayoutTests:

Note that dump-as-markup.js is modified here to put both template content and its direct children. This was an oversight and fixing it will make it
easier to spot parse errors like ones that arise from this bug, where nodes are appended directly to the template element.

* html5lib/resources/template.dat:
* resources/dump-as-markup.js:
(Markup._get):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@141327 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/html5lib/resources/template.dat
LayoutTests/resources/dump-as-markup.js
Source/WebCore/ChangeLog
Source/WebCore/dom/ContainerNode.cpp
Source/WebCore/html/parser/HTMLTreeBuilder.cpp

index d00b3d5..02ab563 100644 (file)
@@ -1,3 +1,17 @@
+2013-01-30  Rafael Weinstein  <rafaelw@chromium.org>
+
+        [HTMLTemplateElement] prevent the parser from removing nodes from the content when the foster agency is processing formatting elements
+        https://bugs.webkit.org/show_bug.cgi?id=108377
+
+        Reviewed by Adam Barth.
+
+        Note that dump-as-markup.js is modified here to put both template content and its direct children. This was an oversight and fixing it will make it
+        easier to spot parse errors like ones that arise from this bug, where nodes are appended directly to the template element.
+
+        * html5lib/resources/template.dat:
+        * resources/dump-as-markup.js:
+        (Markup._get):
+
 2013-01-30  Philip Rogers  <pdr@google.com>
 
         Update fast/backgrounds/size/contain-and-cover-zoomed test expectations.
index 66fbe20..6bbd487 100644 (file)
 |     <template>
 |       #document-fragment
 |         <col>
+
+#data
+<body><template><i><menu>Foo</i>
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <template>
+|       #document-fragment
+|         <i>
+|         <menu>
+|           <i>
+|             "Foo"
index 437be6c..e2a6975 100644 (file)
@@ -224,19 +224,16 @@ Markup._get = function(node, depth, shadowRootList)
         else
           str += "#document-fragment";
     }
-    
-    
-    // HTML Template elements serialize their content DocumentFragment, and NOT their children.
-    if (node.namespaceURI = 'http://www.w3.org/1999/xhtml' && node.tagName == 'TEMPLATE') {
+
+    if (node.namespaceURI = 'http://www.w3.org/1999/xhtml' && node.tagName == 'TEMPLATE')
         str += Markup._get(node.content, depth + 1, shadowRootList);
-    } else {
-        for (var i = 0, len = node.childNodes.length; i < len; i++) {
-            var selection = Markup._getSelectionMarker(node, i);
-            if (selection)
-                str += Markup._indent(depth + 1) + selection;
-    
-            str += Markup._get(node.childNodes[i], depth + 1, shadowRootList);
-        }
+
+    for (var i = 0, len = node.childNodes.length; i < len; i++) {
+        var selection = Markup._getSelectionMarker(node, i);
+        if (selection)
+            str += Markup._indent(depth + 1) + selection;
+
+        str += Markup._get(node.childNodes[i], depth + 1, shadowRootList);
     }
     
     str += Markup._getShadowHostIfPossible(node, depth, shadowRootList);
index e548b32..bb8c292 100644 (file)
@@ -1,3 +1,22 @@
+2013-01-30  Rafael Weinstein  <rafaelw@chromium.org>
+
+        [HTMLTemplateElement] prevent the parser from removing nodes from the content when the foster agency is processing formatting elements
+        https://bugs.webkit.org/show_bug.cgi?id=108377
+
+        Reviewed by Adam Barth.
+
+        https://dvcs.w3.org/hg/webcomponents/raw-file/50ce1f368c1a/spec/templates/index.html#in-body-addition
+
+        callTheAdoptionAgency now appends to the template's content when it previously would have appended to the template element itself.
+
+        New test added to html5lib.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::parserInsertBefore):
+        (WebCore::ContainerNode::parserAppendChild):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+
 2013-01-30  Mark Lam  <mark.lam@apple.com>
 
         DatabaseContext should implement ThreadSafeRefCounted.
index d4f71b8..564d9d2 100644 (file)
@@ -32,6 +32,7 @@
 #include "FloatRect.h"
 #include "Frame.h"
 #include "FrameView.h"
+#include "HTMLNames.h"
 #include "InlineTextBox.h"
 #include "InsertionPoint.h"
 #include "InspectorInstrumentation.h"
@@ -329,6 +330,9 @@ void ContainerNode::parserInsertBefore(PassRefPtr<Node> newChild, Node* nextChil
     ASSERT(nextChild);
     ASSERT(nextChild->parentNode() == this);
     ASSERT(!newChild->isDocumentFragment());
+#if ENABLE(TEMPLATE_ELEMENT)
+    ASSERT(!hasTagName(HTMLNames::templateTag));
+#endif
 
     if (nextChild->previousSibling() == newChild || nextChild == newChild) // nothing to do
         return;
@@ -697,6 +701,9 @@ void ContainerNode::parserAppendChild(PassRefPtr<Node> newChild)
     ASSERT(newChild);
     ASSERT(!newChild->parentNode()); // Use appendChild if you need to handle reparenting (and want DOM mutation events).
     ASSERT(!newChild->isDocumentFragment());
+#if ENABLE(TEMPLATE_ELEMENT)
+    ASSERT(!hasTagName(HTMLNames::templateTag));
+#endif
 
     if (document() != newChild->document())
         document()->adoptNode(newChild.get(), ASSERT_NO_EXCEPTION);
index c70119d..78313ee 100644 (file)
@@ -34,6 +34,7 @@
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
 #include "HTMLStackItem.h"
+#include "HTMLTemplateElement.h"
 #include "HTMLToken.h"
 #include "HTMLTokenizer.h"
 #include "LocalizedStrings.h"
@@ -1587,7 +1588,14 @@ void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken* token)
         if (commonAncestor->causesFosterParenting())
             m_tree.fosterParent(lastNode->element());
         else {
+#if ENABLE(TEMPLATE_ELEMENT)
+            if (commonAncestor->hasTagName(templateTag))
+                toHTMLTemplateElement(commonAncestor->node())->content()->parserAppendChild(lastNode->element());
+            else
+                commonAncestor->node()->parserAppendChild(lastNode->element());
+#else
             commonAncestor->node()->parserAppendChild(lastNode->element());
+#endif
             ASSERT(lastNode->stackItem()->isElementNode());
             ASSERT(lastNode->element()->parentNode());
             if (lastNode->element()->parentNode()->attached() && !lastNode->element()->attached())