git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 6e91a96)
Unreviewed, rolling out r142531.
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 12 Feb 2013 13:27:45 +0000 (13:27 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 12 Feb 2013 13:27:45 +0000 (13:27 +0000)
http://trac.webkit.org/changeset/142531
https://bugs.webkit.org/show_bug.cgi?id=109569

Causes html5lib/run-template layout test to crash. (Requested
by atwilson_ on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2013-02-12

Source/WebCore:

* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::processTemplateEndTag):
(WebCore::HTMLTreeBuilder::processColgroupEndTagForInColumnGroup):
(WebCore::HTMLTreeBuilder::processEndOfFile):
* html/parser/HTMLTreeBuilder.h:
(HTMLTreeBuilder):

LayoutTests:

* html5lib/resources/template.dat:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@142607 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/html5lib/resources/template.dat patch | blob | history
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/html/parser/HTMLTreeBuilder.cpp patch | blob | history
Source/WebCore/html/parser/HTMLTreeBuilder.h patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 0ed9554740bf2c90ef62d54bc8d5801c280e2aea..cf623261247cbe8081e6d7b0a42cfbb7ca41deb9 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2013-02-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r142531.
+        http://trac.webkit.org/changeset/142531
+        https://bugs.webkit.org/show_bug.cgi?id=109569
+
+        Causes html5lib/run-template layout test to crash. (Requested
+        by atwilson_ on #webkit).
+
+        * html5lib/resources/template.dat:
+
 2013-02-12  Zan Dobersek  <zdobersek@igalia.com>
 
         [GTK] Enable CSS image-set support in development builds
diff --git a/LayoutTests/html5lib/resources/template.dat b/LayoutTests/html5lib/resources/template.dat
index f48f27daa95965c95b693d652458ca81f3dcf25e..31eb96b5c7738f99bf3c8284c0253d9a18530274 100644 (file)
--- a/LayoutTests/html5lib/resources/template.dat
+++ b/LayoutTests/html5lib/resources/template.dat
@@ -983,211 +983,3 @@
 |           <tr>
 |             <td>
 |               "Foo"
-
-#data
-<template></figcaption><sub><table></table>
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <sub>
-|           <table>
-|   <body>
-
-#data
-<template><template>
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|   <body>
-
-#data
-<template><div>
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <div>
-|   <body>
-
-#data
-<template><template><div>
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|             <div>
-|   <body>
-
-#data
-<template><template><table>
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|             <table>
-|   <body>
-
-#data
-<template><template><tbody>
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|             <tbody>
-|   <body>
-
-#data
-<template><template><tr>
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|             <tr>
-|   <body>
-
-#data
-<template><template><td>
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|             <td>
-|   <body>
-
-#data
-<template><template><caption>
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|             <caption>
-|   <body>
-
-#data
-<template><template><colgroup>
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|             <colgroup>
-|   <body>
-
-#data
-<template><template><col>
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|             <col>
-|   <body>
-
-#data
-<template><template><tbody><select>
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|             <tbody>
-|             <select>
-|   <body>
-
-#data
-<template><template><table>Foo
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|             <table>
-|             "Foo"
-|   <body>
-
-#data
-<template><template><frame>
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|             <frame>
-|   <body>
-
-#data
-<template><template><script>var i
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|             <script>
-|               "var i"
-|   <body>
-
-#data
-<template><template><style>var i
-#errors
-#document
-| <html>
-|   <head>
-|     <template>
-|       #document-fragment
-|         <template>
-|           #document-fragment
-|             <style>
-|               "var i"
-|   <body>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index de95ad5d5157897a2c1426faa190ef27d6f66f7d..e54f11792fedddaff15d2e3d75f0b9810c9635b6 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2013-02-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r142531.
+        http://trac.webkit.org/changeset/142531
+        https://bugs.webkit.org/show_bug.cgi?id=109569
+
+        Causes html5lib/run-template layout test to crash. (Requested
+        by atwilson_ on #webkit).
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processTemplateEndTag):
+        (WebCore::HTMLTreeBuilder::processColgroupEndTagForInColumnGroup):
+        (WebCore::HTMLTreeBuilder::processEndOfFile):
+        * html/parser/HTMLTreeBuilder.h:
+        (HTMLTreeBuilder):
+
 2013-02-12  Zan Dobersek  <zdobersek@igalia.com>
 
         [GTK] Enable CSS image-set support in development builds
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 8916cbe97cb65b9197450084611cf33b1777d4dd..ab0513498d181a58b8dad58e39331e8e227d9c6f 100644 (file)
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -969,33 +969,11 @@ void HTMLTreeBuilder::processTemplateEndTag(AtomicHTMLToken* token)
     m_templateInsertionModes.removeLast();
     resetInsertionModeAppropriately();
 }
-
-bool HTMLTreeBuilder::popAllTemplatesForEndOfFile()
-{
-    if (m_templateInsertionModes.isEmpty())
-        return false;
-
-    while (!m_templateInsertionModes.isEmpty()) {
-        if (m_tree.currentIsRootNode())
-            return false;
-        if (m_tree.currentNode()->hasTagName(templateTag))
-            m_templateInsertionModes.removeLast();
-        m_tree.openElements()->pop();
-    }
-
-    resetInsertionModeAppropriately();
-    return true;
-}
 #endif
 
 bool HTMLTreeBuilder::processColgroupEndTagForInColumnGroup()
 {
-    bool ignoreFakeEndTag = m_tree.currentIsRootNode();
-#if ENABLE(TEMPLATE_ELEMENT)
-    ignoreFakeEndTag = ignoreFakeEndTag || m_tree.currentNode()->hasTagName(templateTag);
-#endif
-
-    if (ignoreFakeEndTag) {
+    if (m_tree.currentIsRootNode() || m_tree.currentNode()->hasTagName(templateTag)) {
         ASSERT(isParsingFragmentOrTemplateContents());
         // FIXME: parse error
         return false;
@@ -2523,6 +2501,9 @@ void HTMLTreeBuilder::processCharacterBufferForInBody(ExternalCharacterTokenBuff
 void HTMLTreeBuilder::processEndOfFile(AtomicHTMLToken* token)
 {
     ASSERT(token->type() == HTMLTokenTypes::EndOfFile);
+#if ENABLE(TEMPLATE_ELEMENT)
+    m_templateInsertionModes.clear();
+#endif
     switch (insertionMode()) {
     case InitialMode:
         ASSERT(insertionMode() == InitialMode);
@@ -2555,12 +2536,6 @@ void HTMLTreeBuilder::processEndOfFile(AtomicHTMLToken* token)
         ASSERT(insertionMode() == InBodyMode || insertionMode() == InCellMode || insertionMode() == InCaptionMode || insertionMode() == InRowMode);
 #endif
         notImplemented(); // Emit parse error based on what elements are still open.
-#if ENABLE(TEMPLATE_ELEMENT)
-        if (popAllTemplatesForEndOfFile()) {
-            processEndOfFile(token);
-            return;
-        }
-#endif
         break;
     case AfterBodyMode:
     case AfterAfterBodyMode:
@@ -2575,34 +2550,26 @@ void HTMLTreeBuilder::processEndOfFile(AtomicHTMLToken* token)
     case AfterAfterFramesetMode:
         ASSERT(insertionMode() == AfterFramesetMode || insertionMode() == AfterAfterFramesetMode);
         break;
-    case InColumnGroupMode:
-        if (m_tree.currentIsRootNode()) {
-            ASSERT(isParsingFragment());
-            return; // FIXME: Should we break here instead of returning?
-        }
-#if ENABLE(TEMPLATE_ELEMENT)
-        ASSERT(m_tree.currentNode()->hasTagName(colgroupTag));
-#else
-        ASSERT(m_tree.currentNode()->hasTagName(colgroupTag) || m_tree.currentNode()->hasTagName(templateTag));
-#endif
-        processColgroupEndTagForInColumnGroup();
-        // Fall through
     case InFramesetMode:
     case InTableMode:
     case InTableBodyMode:
     case InSelectInTableMode:
     case InSelectMode:
-        ASSERT(insertionMode() == InSelectMode || insertionMode() == InSelectInTableMode || insertionMode() == InTableMode || insertionMode() == InFramesetMode || insertionMode() == InTableBodyMode || insertionMode() == InColumnGroupMode);
+        ASSERT(insertionMode() == InSelectMode || insertionMode() == InSelectInTableMode || insertionMode() == InTableMode || insertionMode() == InFramesetMode || insertionMode() == InTableBodyMode);
         if (m_tree.currentNode() != m_tree.openElements()->rootNode())
             parseError(token);
-
-#if ENABLE(TEMPLATE_ELEMENT)
-        if (popAllTemplatesForEndOfFile()) {
-            processEndOfFile(token);
-            return;
-        }
-#endif
         break;
+    case InColumnGroupMode:
+        if (m_tree.currentIsRootNode()) {
+            ASSERT(isParsingFragment());
+            return; // FIXME: Should we break here instead of returning?
+        }
+        if (!processColgroupEndTagForInColumnGroup()) {
+            ASSERT(isParsingFragmentOrTemplateContents());
+            return; // FIXME: Should we break here instead of returning?
+        }
+        processEndOfFile(token);
+        return;
     case InTableTextMode:
         defaultForInTableText();
         processEndOfFile(token);
@@ -2617,16 +2584,15 @@ void HTMLTreeBuilder::processEndOfFile(AtomicHTMLToken* token)
         processEndOfFile(token);
         return;
     case TemplateContentsMode:
-#if ENABLE(TEMPLATE_ELEMENT)
-        parseError(token);
-        if (popAllTemplatesForEndOfFile()) {
-            processEndOfFile(token);
-            return;
+        if (m_tree.currentIsRootNode()) {
+            ASSERT(isParsingFragment());
+            break;
         }
-        break;
-#else
-        ASSERT_NOT_REACHED();
-#endif
+        parseError(token);
+        m_tree.openElements()->pop();
+        resetInsertionModeAppropriately();
+        processEndOfFile(token);
+        return;
     }
     ASSERT(m_tree.currentNode());
     m_tree.openElements()->popAll();
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.h b/Source/WebCore/html/parser/HTMLTreeBuilder.h
index 7dbc89c54cf6a0a299398b95e87b722728950b06..47e1d825f5d5831069a0721a5002ef39008c60c6 100644 (file)
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.h
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.h
@@ -195,7 +195,6 @@ private:
 #if ENABLE(TEMPLATE_ELEMENT)
     void processTemplateStartTag(AtomicHTMLToken*);
     void processTemplateEndTag(AtomicHTMLToken*);
-    bool popAllTemplatesForEndOfFile();
 #endif
 
     class FragmentParsingContext {
Mirror of the WebKit open source project from svn.webkit.org.