From 0c91da2f09dcb2ae98fd50d4b0d66984150127a7 Mon Sep 17 00:00:00 2001
From: "abarth@webkit.org"
 <abarth@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Tue, 21 Feb 2012 07:32:52 +0000
Subject: [PATCH] Invalid cast in WebCore::toElement /
 WebCore::HTMLElementStack::ElementRecord::element
 https://bugs.webkit.org/show_bug.cgi?id=78975

Reviewed by Eric Seidel.

Source/WebCore:

We're supposed to set the action attribute on the form element we just
created.  Previously, we assumed the newly created form element would
be on the top of the stack of open elements, but if we're in the table
body insertion mode, the form element gets treated as self closing and
is therefore popped off the stack of open elements.

Fortunately, we already cache a pointer to the most recently inserted
form element on the HTMLConstructionSite, so we can just grab the
element from there.

Test: html5lib/runner.html

* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::processIsindexStartTagForInBody):
(WebCore):

LayoutTests:

* html5lib/resourcesl/webkit-02.dat:


git-svn-id: https://svn.webkit.org/repository/webkit/trunk@108311 268f45cc-cd09-0410-ab3c-d52691b4dbfc
---
 LayoutTests/ChangeLog                          |  9 +++++++++
 LayoutTests/html5lib/resources/webkit02.dat    | 15 +++++++++++++++
 Source/WebCore/ChangeLog                       | 23 +++++++++++++++++++++++
 Source/WebCore/html/parser/HTMLTreeBuilder.cpp |  6 ++----
 4 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 7f55dd1..5d70728 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,12 @@
+2012-02-20  Adam Barth  <abarth@webkit.org>
+
+        Invalid cast in WebCore::toElement / WebCore::HTMLElementStack::ElementRecord::element
+        https://bugs.webkit.org/show_bug.cgi?id=78975
+
+        Reviewed by Eric Seidel.
+
+        * html5lib/resourcesl/webkit-02.dat:
+
 2012-02-20  Csaba Osztrogonác  <ossy@webkit.org>
 
         [Qt] Unreviewed gardening after r108259.
diff --git a/LayoutTests/html5lib/resources/webkit02.dat b/LayoutTests/html5lib/resources/webkit02.dat
index ba0c5a6..8ea5538 100644
--- a/LayoutTests/html5lib/resources/webkit02.dat
+++ b/LayoutTests/html5lib/resources/webkit02.dat
@@ -134,3 +134,18 @@ div
 | <aside>
 |   <em>
 |     <b>
+
+#data
+<isindex action="x">
+#errors
+#document-fragment
+table
+#document
+| <form>
+|   action="x"
+| <hr>
+| <label>
+|   "This is a searchable index. Enter search keywords: "
+|   <input>
+|     name="isindex"
+| <hr>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index de7cea7..cc987f2 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,5 +1,28 @@
 2012-02-20  Adam Barth  <abarth@webkit.org>
 
+        Invalid cast in WebCore::toElement / WebCore::HTMLElementStack::ElementRecord::element
+        https://bugs.webkit.org/show_bug.cgi?id=78975
+
+        Reviewed by Eric Seidel.
+
+        We're supposed to set the action attribute on the form element we just
+        created.  Previously, we assumed the newly created form element would
+        be on the top of the stack of open elements, but if we're in the table
+        body insertion mode, the form element gets treated as self closing and
+        is therefore popped off the stack of open elements.
+
+        Fortunately, we already cache a pointer to the most recently inserted
+        form element on the HTMLConstructionSite, so we can just grab the
+        element from there.
+
+        Test: html5lib/runner.html
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processIsindexStartTagForInBody):
+        (WebCore):
+
+2012-02-20  Adam Barth  <abarth@webkit.org>
+
         Unite TextTrack-related files with their friends in WebCore/html/track
         https://bugs.webkit.org/show_bug.cgi?id=78941
 
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 9d83912..3b54149 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -586,10 +586,8 @@ void HTMLTreeBuilder::processIsindexStartTagForInBody(AtomicHTMLToken& token)
     notImplemented(); // Acknowledge self-closing flag
     processFakeStartTag(formTag);
     RefPtr<Attribute> actionAttribute = token.getAttributeItem(actionAttr);
-    if (actionAttribute) {
-        ASSERT(m_tree.currentElement()->hasTagName(formTag));
-        m_tree.currentElement()->setAttribute(actionAttr, actionAttribute->value());
-    }
+    if (actionAttribute)
+        m_tree.form()->setAttribute(actionAttr, actionAttribute->value());
     processFakeStartTag(hrTag);
     processFakeStartTag(labelTag);
     RefPtr<Attribute> promptAttribute = token.getAttributeItem(promptAttr);
-- 
1.8.3.1