[HTML parser] reset insertion mode appropriate must check for "in select in table...
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 21 Nov 2013 06:10:31 +0000 (06:10 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 21 Nov 2013 06:10:31 +0000 (06:10 +0000)
https://bugs.webkit.org/show_bug.cgi?id=123850

Reviewed by Antti Koivisto.

Source/WebCore:

Merge https://chromium.googlesource.com/chromium/blink/+/2cb7523df57dfb48111f6aa16b7138cd54024ba7

The HTML specification has been updated to detect encountering a template element inside of a select element,
which in turn is inside of a table element. In this case, the select element will cause the parser to be in
"InSelectInTable" mode. Thus when the template element closes, it should return to that mode.

The fix here is that resetInsertionModeAppropriately must continue looking up the stack if the first node is
select element to see whether the select element is inside of a table element.

See also: http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#reset-the-insertion-mode-appropriately

Test: html5lib/resources/template.dat

* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately):

LayoutTests:

* html5lib/resources/template.dat:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@159607 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/html5lib/resources/template.dat
Source/WebCore/ChangeLog
Source/WebCore/html/parser/HTMLTreeBuilder.cpp

index 271ef03..5ca259a 100644 (file)
@@ -1,5 +1,14 @@
 2013-11-20  Ryosuke Niwa  <rniwa@webkit.org>
 
+        [HTML parser] reset insertion mode appropriate must check for "in select in table" mode
+        https://bugs.webkit.org/show_bug.cgi?id=123850
+
+        Reviewed by Antti Koivisto.
+
+        * html5lib/resources/template.dat:
+
+2013-11-20  Ryosuke Niwa  <rniwa@webkit.org>
+
         Clear TemplateContentDocumentFragment::m_host when HTMLTemplateElement is destroyed
         https://bugs.webkit.org/show_bug.cgi?id=122806
 
index bc66ee8..390ed0c 100644 (file)
 |       <template>
 |         content
 |           <span>
+
+#data
+<body><table><tr><td><select><template>Foo</template><caption>A</table>
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <table>
+|       <tbody>
+|         <tr>
+|           <td>
+|             <select>
+|               <template>
+|                 content
+|                   "Foo"
+|       <caption>
+|         "A"
index 47ed199..98d9259 100644 (file)
@@ -1,3 +1,26 @@
+2013-11-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        [HTML parser] reset insertion mode appropriate must check for "in select in table" mode
+        https://bugs.webkit.org/show_bug.cgi?id=123850
+
+        Reviewed by Antti Koivisto.
+
+        Merge https://chromium.googlesource.com/chromium/blink/+/2cb7523df57dfb48111f6aa16b7138cd54024ba7
+
+        The HTML specification has been updated to detect encountering a template element inside of a select element,
+        which in turn is inside of a table element. In this case, the select element will cause the parser to be in
+        "InSelectInTable" mode. Thus when the template element closes, it should return to that mode.
+
+        The fix here is that resetInsertionModeAppropriately must continue looking up the stack if the first node is
+        select element to see whether the select element is inside of a table element.
+
+        See also: http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#reset-the-insertion-mode-appropriately
+
+        Test: html5lib/resources/template.dat
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately):
+
 2013-11-20  Mark Lam  <mark.lam@apple.com>
 
         Build fix for last commit.
index 05f7cc0..4a5d091 100644 (file)
@@ -1641,6 +1641,16 @@ void HTMLTreeBuilder::resetInsertionModeAppropriately()
             return setInsertionMode(m_templateInsertionModes.last());
 #endif
         if (item->hasTagName(selectTag)) {
+#if ENABLE(TEMPLATE_ELEMENT)
+            if (!last) {
+                while (item->node() != m_tree.openElements()->rootNode() && !item->hasTagName(templateTag)) {
+                    nodeRecord = nodeRecord->next();
+                    item = nodeRecord->stackItem();
+                    if (isHTMLTableElement(item->node()))
+                        return setInsertionMode(InSelectInTableMode);
+                }
+            }
+#endif
             return setInsertionMode(InSelectMode);
         }
         if (item->hasTagName(tdTag) || item->hasTagName(thTag))