WebCore:

        Reviewed by Hyatt.

        Another go at fix for <rdar://problem/4820814> A crash occurs at
        WebCore::HitTestResult::spellingToolTip() when mousing down on
        iframe at www.macsurfer.com

        The fix from yesterday caused a layout test regression which
        exposed an existing bug. The existing bug was that we allowed text
        nodes to stay in the head tag, but other browsers move them to the
        body. The previous fix also caused a performance regression, which
        was seemingly easy to fix by moving the new clause in
        HTMLParser::handleError() to be below the HTMLElement case.

        * html/HTMLDocument.cpp:
        (WebCore::HTMLDocument::childAllowed): Don't allow comment nodes to
        be the child of the document.
        * html/HTMLHeadElement.cpp:
        (WebCore::HTMLHeadElement::childAllowed): Do not allow non-
        whitespace text nodes to be children of the head.
        * html/HTMLHeadElement.h:
        * html/HTMLParser.cpp:
        (WebCore::HTMLParser::handleError): Error case for comment nodes.
        * page/FrameView.cpp:
        (WebCore::FrameView::handleMousePressEvent): Safety-net null check
        for the original crash.

Layout Tests:
        Reviewed by Hyatt.

        Test cases for <rdar://problem/4820814> A crash occurs at
        WebCore::HitTestResult::spellingToolTip() when mousing down on
        iframe at www.macsurfer.com

        And for the found-bug of moving text nodes within the head to the
        body.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@17656 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 8c860b6d11f011fba42a314f4bb7e4978fb56b54..23414aaa00f861c43ffd24cd0a6b01f2911aa86e 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,43 @@
+2006-11-07  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Hyatt.
+
+        Test cases for <rdar://problem/4820814> A crash occurs at 
+        WebCore::HitTestResult::spellingToolTip() when mousing down on 
+        iframe at www.macsurfer.com
+
+        And for the found-bug of moving text nodes within the head to the  
+        body.
+
+        * fast/dom/HTMLHeadElement/textInHead1-expected.checksum: Added.
+        * fast/dom/HTMLHeadElement/textInHead1-expected.png: Added.
+        * fast/dom/HTMLHeadElement/textInHead1-expected.txt: Added.
+        * fast/dom/HTMLHeadElement/textInHead1.html: Added.
+        * fast/dom/HTMLHeadElement/textInHead2-expected.checksum: Added.
+        * fast/dom/HTMLHeadElement/textInHead2-expected.png: Added.
+        * fast/dom/HTMLHeadElement/textInHead2-expected.txt: Added.
+        * fast/dom/HTMLHeadElement/textInHead2.html: Added.
+        * fast/dom/HTMLHeadElement/textInHead3-expected.checksum: Added.
+        * fast/dom/HTMLHeadElement/textInHead3-expected.png: Added.
+        * fast/dom/HTMLHeadElement/textInHead3-expected.txt: Added.
+        * fast/dom/HTMLHeadElement/textInHead3.html: Added.
+        * fast/dom/HTMLHeadElement/textInHead4-expected.checksum: Added.
+        * fast/dom/HTMLHeadElement/textInHead4-expected.png: Added.
+        * fast/dom/HTMLHeadElement/textInHead4-expected.txt: Added.
+        * fast/dom/HTMLHeadElement/textInHead4.html: Added.
+        * fast/dom/HTMLHeadElement/textInHead5-expected.checksum: Added.
+        * fast/dom/HTMLHeadElement/textInHead5-expected.png: Added.
+        * fast/dom/HTMLHeadElement/textInHead5-expected.txt: Added.
+        * fast/dom/HTMLHeadElement/textInHead5.html: Added.
+        * fast/frames/onlyCommentInIFrame-expected.checksum: Added.
+        * fast/frames/onlyCommentInIFrame-expected.txt: Added.
+        * fast/frames/onlyCommentInIFrame.html: Added.
+        * fast/frames/resources/comment.html: Added.
+        * fast/frames/resources/commentX.xhtml: Added.
+        * tables/mozilla/bugs/bug1224-expected.checksum:
+        * tables/mozilla/bugs/bug1224-expected.png:
+        * tables/mozilla/bugs/bug1224-expected.txt:
+
 2006-11-07  David Harrison  <harrison@apple.com>
 
         Updated.

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead1-expected.checksum b/LayoutTests/fast/dom/HTMLHeadElement/textInHead1-expected.checksum
new file mode 100644 (file)
index 0000000..a565b52
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead1-expected.checksum
@@ -0,0 +1 @@
+44e021cc33dfc7979bdea1e5e8bf18ac
\ No newline at end of file

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead1-expected.png b/LayoutTests/fast/dom/HTMLHeadElement/textInHead1-expected.png
new file mode 100644 (file)
index 0000000..3b7e720
Binary files /dev/null and b/LayoutTests/fast/dom/HTMLHeadElement/textInHead1-expected.png differ

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead1-expected.txt b/LayoutTests/fast/dom/HTMLHeadElement/textInHead1-expected.txt
new file mode 100644 (file)
index 0000000..512245c
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead1-expected.txt
@@ -0,0 +1,11 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderText {#text} at (0,0) size 31x18
+        text run at (0,0) width 31: "hello"
+      RenderText {#text} at (31,0) size 21x18
+        text run at (31,0) width 21: "test"
+      RenderText {#text} at (52,0) size 34x18
+        text run at (52,0) width 34: "again"

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead1.html b/LayoutTests/fast/dom/HTMLHeadElement/textInHead1.html
new file mode 100644 (file)
index 0000000..cef0e86
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead1.html
@@ -0,0 +1 @@
+<!--here is my comment-->hello<head>test</head><body>again</body>
\ No newline at end of file

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead2-expected.checksum b/LayoutTests/fast/dom/HTMLHeadElement/textInHead2-expected.checksum
new file mode 100644 (file)
index 0000000..a565b52
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead2-expected.checksum
@@ -0,0 +1 @@
+44e021cc33dfc7979bdea1e5e8bf18ac
\ No newline at end of file

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead2-expected.png b/LayoutTests/fast/dom/HTMLHeadElement/textInHead2-expected.png
new file mode 100644 (file)
index 0000000..3b7e720
Binary files /dev/null and b/LayoutTests/fast/dom/HTMLHeadElement/textInHead2-expected.png differ

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead2-expected.txt b/LayoutTests/fast/dom/HTMLHeadElement/textInHead2-expected.txt
new file mode 100644 (file)
index 0000000..512245c
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead2-expected.txt
@@ -0,0 +1,11 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderText {#text} at (0,0) size 31x18
+        text run at (0,0) width 31: "hello"
+      RenderText {#text} at (31,0) size 21x18
+        text run at (31,0) width 21: "test"
+      RenderText {#text} at (52,0) size 34x18
+        text run at (52,0) width 34: "again"

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead2.html b/LayoutTests/fast/dom/HTMLHeadElement/textInHead2.html
new file mode 100644 (file)
index 0000000..40cf33c
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead2.html
@@ -0,0 +1 @@
+hello<head>test</head><body>again</body>
\ No newline at end of file

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead3-expected.checksum b/LayoutTests/fast/dom/HTMLHeadElement/textInHead3-expected.checksum
new file mode 100644 (file)
index 0000000..7fca5c7
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead3-expected.checksum
@@ -0,0 +1 @@
+ad2cbd076d8999068a14fc0b1c17bfbc
\ No newline at end of file

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead3-expected.png b/LayoutTests/fast/dom/HTMLHeadElement/textInHead3-expected.png
new file mode 100644 (file)
index 0000000..e66c6a0
Binary files /dev/null and b/LayoutTests/fast/dom/HTMLHeadElement/textInHead3-expected.png differ

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead3-expected.txt b/LayoutTests/fast/dom/HTMLHeadElement/textInHead3-expected.txt
new file mode 100644 (file)
index 0000000..3f946ee
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead3-expected.txt
@@ -0,0 +1,9 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderText {#text} at (0,0) size 21x18
+        text run at (0,0) width 21: "test"
+      RenderText {#text} at (21,0) size 34x18
+        text run at (21,0) width 34: "again"

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead3.html b/LayoutTests/fast/dom/HTMLHeadElement/textInHead3.html
new file mode 100644 (file)
index 0000000..98087d7
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead3.html
@@ -0,0 +1 @@
+<head>test</head><body>again</body>
\ No newline at end of file

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead4-expected.checksum b/LayoutTests/fast/dom/HTMLHeadElement/textInHead4-expected.checksum
new file mode 100644 (file)
index 0000000..13f6ace
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead4-expected.checksum
@@ -0,0 +1 @@
+e05d6a764535d3c420053a141e385943
\ No newline at end of file

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead4-expected.png b/LayoutTests/fast/dom/HTMLHeadElement/textInHead4-expected.png
new file mode 100644 (file)
index 0000000..4861204
Binary files /dev/null and b/LayoutTests/fast/dom/HTMLHeadElement/textInHead4-expected.png differ

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead4-expected.txt b/LayoutTests/fast/dom/HTMLHeadElement/textInHead4-expected.txt
new file mode 100644 (file)
index 0000000..4d81ff9
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead4-expected.txt
@@ -0,0 +1,11 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x34
+  RenderBlock {HTML} at (0,0) size 800x34
+    RenderBody {BODY} at (8,8) size 784x18
+      RenderText {#text} at (0,0) size 23x18
+        text run at (0,0) width 23: "text"
+      RenderText {#text} at (23,0) size 4x18
+        text run at (23,0) width 4: " "
+      RenderText {#text} at (27,0) size 21x18
+        text run at (27,0) width 21: "test"

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead4.html b/LayoutTests/fast/dom/HTMLHeadElement/textInHead4.html
new file mode 100644 (file)
index 0000000..25d6dd5
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead4.html
@@ -0,0 +1,2 @@
+<head>   <script></script>    <script></script>text<script></script>    </head>
+test
\ No newline at end of file

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead5-expected.checksum b/LayoutTests/fast/dom/HTMLHeadElement/textInHead5-expected.checksum
new file mode 100644 (file)
index 0000000..6b1acc3
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead5-expected.checksum
@@ -0,0 +1 @@
+141d003dbe7f35719ba9e830e8f83af3
\ No newline at end of file

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead5-expected.png b/LayoutTests/fast/dom/HTMLHeadElement/textInHead5-expected.png
new file mode 100644 (file)
index 0000000..3315666
Binary files /dev/null and b/LayoutTests/fast/dom/HTMLHeadElement/textInHead5-expected.png differ

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead5-expected.txt b/LayoutTests/fast/dom/HTMLHeadElement/textInHead5-expected.txt
new file mode 100644 (file)
index 0000000..3e51085
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead5-expected.txt
@@ -0,0 +1,9 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderText {#text} at (0,0) size 29x18
+        text run at (0,0) width 29: "Foo "
+      RenderText {#text} at (29,0) size 76x18
+        text run at (29,0) width 76: "Hello world"

diff --git a/LayoutTests/fast/dom/HTMLHeadElement/textInHead5.html b/LayoutTests/fast/dom/HTMLHeadElement/textInHead5.html
new file mode 100644 (file)
index 0000000..69c186a
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLHeadElement/textInHead5.html
@@ -0,0 +1 @@
+<head>Foo <style>div { color: red }</style></head><body>Hello world
\ No newline at end of file

diff --git a/LayoutTests/fast/frames/onlyCommentInIFrame-expected.checksum b/LayoutTests/fast/frames/onlyCommentInIFrame-expected.checksum
new file mode 100644 (file)
index 0000000..c5d7216
--- /dev/null
+++ b/LayoutTests/fast/frames/onlyCommentInIFrame-expected.checksum
@@ -0,0 +1 @@
+655becf51f13d8a2827fbc4070800270
\ No newline at end of file

diff --git a/LayoutTests/fast/frames/onlyCommentInIFrame-expected.txt b/LayoutTests/fast/frames/onlyCommentInIFrame-expected.txt
new file mode 100644 (file)
index 0000000..42db041
--- /dev/null
+++ b/LayoutTests/fast/frames/onlyCommentInIFrame-expected.txt
@@ -0,0 +1,41 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderText {#text} at (0,0) size 780x54
+        text run at (0,0) width 780: "The documents in the src attributes of the iframes below only contain comments. This test is for a bug where we would only"
+        text run at (0,18) width 773: "construct RenderViews for such iframes. We need to propery construct an empty frame instead, so the RenderView should"
+        text run at (0,36) width 502: "have a RenderBlock and RenderBody below it in the dump of the RenderTree. "
+      RenderBR {BR} at (502,50) size 0x0
+      RenderPartObject {IFRAME} at (0,54) size 784x10
+        layer at (0,0) size 767x8
+          RenderView at (0,0) size 767x6
+        layer at (0,0) size 767x8
+          RenderBlock {HTML} at (0,0) size 767x8
+            RenderBody {BODY} at (8,8) size 751x0
+      RenderText {#text} at (0,0) size 0x0
+      RenderBR {BR} at (0,0) size 0x0
+      RenderBR {BR} at (0,64) size 0x18
+      RenderPartObject {IFRAME} at (0,82) size 784x10
+        layer at (0,0) size 767x130
+          RenderView at (0,0) size 767x6
+        layer at (0,0) size 767x130
+          RenderBlock {html} at (0,0) size 767x130
+            RenderBody {body} at (8,18) size 751x94
+              RenderBlock (anonymous) at (0,0) size 751x0
+                RenderInline {parsererror} at (0,0) size 0x0 [bgcolor=#FFDDDD] [border: (2px solid #CC7777)]
+              RenderBlock (anonymous) at (0,0) size 751x94
+                RenderBlock {h3} at (0,0) size 751x22
+                  RenderText {#text} at (0,0) size 324x22
+                    text run at (0,0) width 324: "This page contains the following errors:"
+                RenderBlock {div} at (0,40) size 751x14
+                  RenderText {#text} at (0,0) size 490x14
+                    text run at (0,0) width 490: "error on line 1 at column 15: Extra content at the end of the document"
+                    text run at (490,0) width 0: " "
+                RenderBlock {h3} at (0,72) size 751x22
+                  RenderText {#text} at (0,0) size 429x22
+                    text run at (0,0) width 429: "Below is a rendering of the page up to the first error."
+              RenderBlock (anonymous) at (0,112) size 751x0
+                RenderInline {parsererror} at (0,0) size 0x0 [bgcolor=#FFDDDD] [border: (2px solid #CC7777)]
+      RenderText {#text} at (0,0) size 0x0

diff --git a/LayoutTests/fast/frames/onlyCommentInIFrame.html b/LayoutTests/fast/frames/onlyCommentInIFrame.html
new file mode 100644 (file)
index 0000000..2f9c13a
--- /dev/null
+++ b/LayoutTests/fast/frames/onlyCommentInIFrame.html
@@ -0,0 +1,11 @@
+<HTML>
+
+<BODY>
+The documents in the src attributes of the iframes below only contain comments. This test is for a bug where we would only construct RenderViews for such iframes. We need to propery construct an empty frame instead, so the RenderView should have a RenderBlock and RenderBody below it in the dump of the RenderTree.
+<br>
+<IFRAME src="resources/comment.html" width="100%" height="10"  frameborder=1 ></IFRAME>
+<br>
+<br>
+<IFRAME src="resources/commentX.xhtml" width="100%" height="10"  frameborder=1 ></IFRAME>
+
+</HTML>
\ No newline at end of file

diff --git a/LayoutTests/fast/frames/resources/comment.html b/LayoutTests/fast/frames/resources/comment.html
new file mode 100644 (file)
index 0000000..a985848
--- /dev/null
+++ b/LayoutTests/fast/frames/resources/comment.html
@@ -0,0 +1 @@
+<!--comment-->
\ No newline at end of file

diff --git a/LayoutTests/fast/frames/resources/commentX.xhtml b/LayoutTests/fast/frames/resources/commentX.xhtml
new file mode 100644 (file)
index 0000000..a985848
--- /dev/null
+++ b/LayoutTests/fast/frames/resources/commentX.xhtml
@@ -0,0 +1 @@
+<!--comment-->
\ No newline at end of file

diff --git a/LayoutTests/tables/mozilla/bugs/bug1224-expected.checksum b/LayoutTests/tables/mozilla/bugs/bug1224-expected.checksum
index 9f68b7673485a8f4abbdf597b961c805771e38e3..d4473cbcd018031318d5311674ca9372b1ec583f 100644 (file)
--- a/LayoutTests/tables/mozilla/bugs/bug1224-expected.checksum
+++ b/LayoutTests/tables/mozilla/bugs/bug1224-expected.checksum
@@ -1 +1 @@
-32ab105476c4b88908d3fdfa6e33d0ac
\ No newline at end of file
+d258ae622d3f38a524410a9601038c6f
\ No newline at end of file

diff --git a/LayoutTests/tables/mozilla/bugs/bug1224-expected.png b/LayoutTests/tables/mozilla/bugs/bug1224-expected.png
index 69bc7c82762d0ac0ed8f1f75297f57ca4d81a275..34f7af515aed5a92c162c2f34900edc8a1ef02c7 100644 (file)
Binary files a/LayoutTests/tables/mozilla/bugs/bug1224-expected.png and b/LayoutTests/tables/mozilla/bugs/bug1224-expected.png differ

diff --git a/LayoutTests/tables/mozilla/bugs/bug1224-expected.txt b/LayoutTests/tables/mozilla/bugs/bug1224-expected.txt
index 3850bf46a7b3a27132b961bd7ba5adde574cb9ea..0a4beba2de43c14ed035272ae972dd654f6bf61c 100644 (file)
--- a/LayoutTests/tables/mozilla/bugs/bug1224-expected.txt
+++ b/LayoutTests/tables/mozilla/bugs/bug1224-expected.txt
@@ -3,7 +3,11 @@ layer at (0,0) size 800x600
 layer at (0,0) size 800x600
   RenderBlock {HTML} at (0,0) size 800x600
     RenderBody {BODY} at (8,8) size 784x584
-      RenderTable {TABLE} at (0,0) size 191x52 [border: (1px outset #808080)]
+      RenderBlock (anonymous) at (0,0) size 784x18
+        RenderText {#text} at (0,0) size 132x18
+          text run at (0,0) width 132: "and the page works.)"
+        RenderText {#text} at (0,0) size 0x0
+      RenderTable {TABLE} at (0,18) size 191x52 [border: (1px outset #808080)]
         RenderTableSection {TBODY} at (1,1) size 189x50
           RenderTableRow {TR} at (0,2) size 189x22
             RenderTableCell {TD} at (2,2) size 97x22 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index a16dde4b64f662fbbae7bc0a513620f72b8e087b..992bbba38a172c9f6e8cd99ebdde896049b8f06b 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,31 @@
+2006-11-07  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Hyatt.
+
+        Another go at fix for <rdar://problem/4820814> A crash occurs at 
+        WebCore::HitTestResult::spellingToolTip() when mousing down on 
+        iframe at www.macsurfer.com
+
+        The fix from yesterday caused a layout test regression which 
+        exposed an existing bug. The existing bug was that we allowed text 
+        nodes to stay in the head tag, but other browsers move them to the 
+        body. The previous fix also caused a performance regression, which 
+        was seemingly easy to fix by moving the new clause in 
+        HTMLParser::handleError() to be below the HTMLElement case.
+
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::childAllowed): Don't allow comment nodes to 
+        be the child of the document.
+        * html/HTMLHeadElement.cpp:
+        (WebCore::HTMLHeadElement::childAllowed): Do not allow non-
+        whitespace text nodes to be children of the head.
+        * html/HTMLHeadElement.h:
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Error case for comment nodes.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::handleMousePressEvent): Safety-net null check 
+        for the original crash. 
+
 2006-11-07  Darin Adler  <darin@apple.com>
 
         - another attempt to fix Qt build

diff --git a/WebCore/html/HTMLDocument.cpp b/WebCore/html/HTMLDocument.cpp
index 1439c8bc640531587b07a50a6d6fa54e90620730..8d1109ef6496ecd11df67437281ec0aea9fa9a64 100644 (file)
--- a/WebCore/html/HTMLDocument.cpp
+++ b/WebCore/html/HTMLDocument.cpp
@@ -127,7 +127,7 @@ Tokenizer *HTMLDocument::createTokenizer()
 
 bool HTMLDocument::childAllowed( Node *newChild )
 {
-    return newChild->hasTagName(htmlTag) || newChild->isCommentNode();
+    return newChild->hasTagName(htmlTag);
 }
 
 PassRefPtr<Element> HTMLDocument::createElement(const String &name, ExceptionCode& ec)

diff --git a/WebCore/html/HTMLHeadElement.cpp b/WebCore/html/HTMLHeadElement.cpp
index 060249576ca31a37ab85c4e249cc642425c7ad7c..a8e7488854b403add92ad04910f147da11250d5f 100644 (file)
--- a/WebCore/html/HTMLHeadElement.cpp
+++ b/WebCore/html/HTMLHeadElement.cpp
@@ -26,6 +26,7 @@
 #include "HTMLHeadElement.h"
 
 #include "HTMLNames.h"
+#include "Text.h"
 
 namespace WebCore {
 
@@ -50,6 +51,15 @@ void HTMLHeadElement::setProfile(const String &value)
     setAttribute(profileAttr, value);
 }
 
+bool HTMLHeadElement::childAllowed(Node* newChild)
+{
+    // Do not allow non-whitespace text nodes in the head
+    if (newChild->isTextNode())
+        return static_cast<Text*>(newChild)->containsOnlyWhitespace();
+    
+    return HTMLElement::childAllowed(newChild);
+}
+
 bool HTMLHeadElement::checkDTD(const Node* newChild)
 {
     return newChild->hasTagName(titleTag) || newChild->hasTagName(isindexTag) ||

diff --git a/WebCore/html/HTMLHeadElement.h b/WebCore/html/HTMLHeadElement.h
index 7931a3145f980042275ec0a053924fa12ce954e5..6380b4da06217e25292dd21025b6769c5fe3fe39 100644 (file)
--- a/WebCore/html/HTMLHeadElement.h
+++ b/WebCore/html/HTMLHeadElement.h
@@ -38,6 +38,7 @@ public:
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusOptional; }
     virtual int tagPriority() const { return 10; }
+    virtual bool childAllowed(Node* newChild);
     virtual bool checkDTD(const Node* newChild);
 
     String profile() const;

diff --git a/WebCore/html/HTMLParser.cpp b/WebCore/html/HTMLParser.cpp
index 73925e1d63f8be2c3ae695ec9f126ee8f8f30b49..415e0a7e26939dbb4fb14e567a1efb3acfda6dcd 100644 (file)
--- a/WebCore/html/HTMLParser.cpp
+++ b/WebCore/html/HTMLParser.cpp
@@ -426,6 +426,16 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                 return insertNode(n);
             }
         }
+    } else if (n->isCommentNode() && !head) { 
+        head = new HTMLHeadElement(document);
+        e = head;
+        insertNode(e);
+        if (head) {
+            head->addChild(n);
+            if (!n->attached() && !m_fragment)
+                n->attach();
+        }
+        return true;
     }
     
     // 2. Next we examine our currently active element to do some further error handling.

diff --git a/WebCore/page/FrameView.cpp b/WebCore/page/FrameView.cpp
index 9fba8f8437e8ac1ea6103edf8234f71db906d56d..d0c761e378085b9168dfb5c1bfaef98c0b5a872d 100644 (file)
--- a/WebCore/page/FrameView.cpp
+++ b/WebCore/page/FrameView.cpp
@@ -596,6 +596,11 @@ void FrameView::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
     
     MouseEventWithHitTestResults mev = prepareMouseEvent(false, true, false, mouseEvent);
 
+    if (!mev.targetNode()) {
+        invalidateClick();
+        return;
+    }
+
     Frame* subframe = subframeForTargetNode(mev.targetNode());
     if (subframe && passMousePressEventToSubframe(mev, subframe)) {
         invalidateClick();