Diff
Modified: trunk/LayoutTests/ChangeLog (91047 => 91048)
--- trunk/LayoutTests/ChangeLog 2011-07-15 04:31:28 UTC (rev 91047)
+++ trunk/LayoutTests/ChangeLog 2011-07-15 04:36:29 UTC (rev 91048)
@@ -1,3 +1,18 @@
+2011-07-14 Kenichi Ishibashi <[email protected]>
+
+ <input form="x"> should not associate the input with any forms when there is no form with id="x"
+ https://bugs.webkit.org/show_bug.cgi?id=64509
+
+ Adds a test for checking input elements don't associate any form elements when they have the form attribute which points nonexistence form.
+ Fixes existing tests that contain unintended form attributes.
+
+ Reviewed by Kent Tamura.
+
+ * fast/forms/form-attribute-nonexistence-form-id-expected.txt: Added.
+ * fast/forms/form-attribute-nonexistence-form-id.html: Added.
+ * fast/forms/script-tests/form-attribute.js: Fixed unintended form attributes.
+ * fast/forms/script-tests/form-collection-elements-order.js: Ditto.
+
2011-07-14 Kent Tamura <[email protected]>
REGRESSION (r90809): Setting a checkbox's checked property, doesn't render as checked until app window loses focus
Added: trunk/LayoutTests/fast/forms/form-attribute-nonexistence-form-id-expected.txt (0 => 91048)
--- trunk/LayoutTests/fast/forms/form-attribute-nonexistence-form-id-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/forms/form-attribute-nonexistence-form-id-expected.txt 2011-07-15 04:36:29 UTC (rev 91048)
@@ -0,0 +1,11 @@
+This page ensures that <input from="X"> don't associate with any form elements when there is no <form id="X">.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS elementShouldHaveForm.form is form
+PASS elementShouldNotHaveForm.form is null
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Property changes on: trunk/LayoutTests/fast/forms/form-attribute-nonexistence-form-id-expected.txt
___________________________________________________________________
Added: svn:eol-style
Added: trunk/LayoutTests/fast/forms/form-attribute-nonexistence-form-id.html (0 => 91048)
--- trunk/LayoutTests/fast/forms/form-attribute-nonexistence-form-id.html (rev 0)
+++ trunk/LayoutTests/fast/forms/form-attribute-nonexistence-form-id.html 2011-07-15 04:36:29 UTC (rev 91048)
@@ -0,0 +1,26 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href=""
+<script src=""
+</head>
+<body>
+<p id="description"></p>
+<form id="form">
+ <input type="hidden" id="input1" value="value1">
+ <input type="hidden" id="input2" value="value2" form="X">
+</form>
+<div id="console"></div>
+<script>
+description('This page ensures that <input from="X"> don\'t associate with any form elements when there is no <form id="X">.');
+
+var form = document.getElementById('form');
+var elementShouldHaveForm = document.getElementById('input1');
+var elementShouldNotHaveForm = document.getElementById('input2');
+shouldBe('elementShouldHaveForm.form', 'form');
+shouldBeNull('elementShouldNotHaveForm.form');
+var successfullyParsed = true;
+</script>
+<script src=""
+</body>
+</html>
Property changes on: trunk/LayoutTests/fast/forms/form-attribute-nonexistence-form-id.html
___________________________________________________________________
Added: svn:eol-style
Modified: trunk/LayoutTests/fast/forms/script-tests/form-attribute.js (91047 => 91048)
--- trunk/LayoutTests/fast/forms/script-tests/form-attribute.js 2011-07-15 04:31:28 UTC (rev 91047)
+++ trunk/LayoutTests/fast/forms/script-tests/form-attribute.js 2011-07-15 04:36:29 UTC (rev 91048)
@@ -61,9 +61,9 @@
debug('NOTE: It seems that nesting form elements is not allowed so we ensure each form-associated elements associate with the outmost form element.');
container.innerHTML = '<form id=owner>' +
' <form>' +
- ' <input id=inputElement1 name=victim form=owner/>' +
+ ' <input id=inputElement1 name=victim form=owner />' +
' <input id=inputElement2 name=victim />' +
- ' <input id=inputElement3 name=victim form=owner/>' +
+ ' <input id=inputElement3 name=victim form=owner />' +
' </form>' +
'</form>';
owner = document.getElementById('owner');
Modified: trunk/LayoutTests/fast/forms/script-tests/form-collection-elements-order.js (91047 => 91048)
--- trunk/LayoutTests/fast/forms/script-tests/form-collection-elements-order.js 2011-07-15 04:31:28 UTC (rev 91047)
+++ trunk/LayoutTests/fast/forms/script-tests/form-collection-elements-order.js 2011-07-15 04:36:29 UTC (rev 91048)
@@ -57,7 +57,7 @@
debug('- Checks the order of form associated elements with form attribute.');
container.innerHTML = '<button name=victim form=owner></button>' +
'<fieldset name=victim form=owner>Test</fieldset>' +
- '<input name=victim form=owner/>' +
+ '<input name=victim form=owner />' +
'<keygen name=victim form=owner></keygen>' +
'<form id=owner>' +
'<label name=victim></label>' +
Modified: trunk/Source/WebCore/ChangeLog (91047 => 91048)
--- trunk/Source/WebCore/ChangeLog 2011-07-15 04:31:28 UTC (rev 91047)
+++ trunk/Source/WebCore/ChangeLog 2011-07-15 04:36:29 UTC (rev 91048)
@@ -1,3 +1,26 @@
+2011-07-14 Kenichi Ishibashi <[email protected]>
+
+ <input form="x"> should not associate the input with any forms when there is no form with id="x"
+ https://bugs.webkit.org/show_bug.cgi?id=64509
+
+ Don't set form owner when a form associated element has the form attribute but there is no such form element.
+
+ Reviewed by Kent Tamura.
+
+ Test: fast/forms/form-attribute-nonexistence-form-id.html
+
+ * dom/Document.cpp:
+ (WebCore::Document::resetFormElementsOwner): Removed the argument which is no longer needed.
+ * dom/Document.h: Ditto.
+ * html/FormAssociatedElement.cpp:
+ (WebCore::FormAssociatedElement::insertedIntoTree): Resets m_form whenever the element has the form attribute.
+ (WebCore::FormAssociatedElement::resetFormOwner): Don't set m_form when there is no form element which has the given id.
+ (WebCore::FormAssociatedElement::formAttributeChanged): Removed the argument of resetFormOwner().
+ * html/FormAssociatedElement.h: Ditto.
+ * html/HTMLFormElement.cpp: Ditto.
+ (WebCore::HTMLFormElement::insertedIntoDocument):
+ (WebCore::HTMLFormElement::removedFromDocument):
+
2011-07-14 Kent Tamura <[email protected]>
REGRESSION (r90809): Setting a checkbox's checked property, doesn't render as checked until app window loses focus
Modified: trunk/Source/WebCore/dom/Document.cpp (91047 => 91048)
--- trunk/Source/WebCore/dom/Document.cpp 2011-07-15 04:31:28 UTC (rev 91047)
+++ trunk/Source/WebCore/dom/Document.cpp 2011-07-15 04:36:29 UTC (rev 91048)
@@ -4373,12 +4373,12 @@
m_formElementsWithFormAttribute.remove(element);
}
-void Document::resetFormElementsOwner(HTMLFormElement* form)
+void Document::resetFormElementsOwner()
{
typedef FormAssociatedElementListHashSet::iterator Iterator;
Iterator end = m_formElementsWithFormAttribute.end();
for (Iterator it = m_formElementsWithFormAttribute.begin(); it != end; ++it)
- (*it)->resetFormOwner(form);
+ (*it)->resetFormOwner();
}
void Document::setUseSecureKeyboardEntryWhenActive(bool usesSecureKeyboard)
Modified: trunk/Source/WebCore/dom/Document.h (91047 => 91048)
--- trunk/Source/WebCore/dom/Document.h 2011-07-15 04:31:28 UTC (rev 91047)
+++ trunk/Source/WebCore/dom/Document.h 2011-07-15 04:36:29 UTC (rev 91048)
@@ -520,7 +520,7 @@
void registerFormElementWithFormAttribute(FormAssociatedElement*);
void unregisterFormElementWithFormAttribute(FormAssociatedElement*);
- void resetFormElementsOwner(HTMLFormElement*);
+ void resetFormElementsOwner();
FrameView* view() const; // can be NULL
Frame* frame() const { return m_frame; } // can be NULL
Modified: trunk/Source/WebCore/html/FormAssociatedElement.cpp (91047 => 91048)
--- trunk/Source/WebCore/html/FormAssociatedElement.cpp 2011-07-15 04:31:28 UTC (rev 91047)
+++ trunk/Source/WebCore/html/FormAssociatedElement.cpp 2011-07-15 04:36:29 UTC (rev 91048)
@@ -77,13 +77,19 @@
{
HTMLElement* element = toHTMLElement(this);
if (element->fastHasAttribute(formAttr)) {
+ // Resets the form owner at first to make sure the element don't
+ // associate any form elements when there is no element which has
+ // the given ID.
+ if (m_form) {
+ m_form->removeFormElement(this);
+ m_form = 0;
+ }
Element* formElement = element->treeScope()->getElementById(element->fastGetAttribute(formAttr));
if (formElement && formElement->hasTagName(formTag)) {
- if (m_form)
- m_form->removeFormElement(this);
m_form = static_cast<HTMLFormElement*>(formElement);
m_form->registerFormElement(this);
}
+ return;
}
if (!m_form) {
// This handles the case of a new form element being created by
@@ -122,7 +128,7 @@
m_form = 0;
}
-void FormAssociatedElement::resetFormOwner(HTMLFormElement* form)
+void FormAssociatedElement::resetFormOwner()
{
HTMLElement* element = toHTMLElement(this);
const AtomicString& formId(element->fastGetAttribute(formAttr));
@@ -140,8 +146,6 @@
Element* firstElement = element->treeScope()->getElementById(formId);
if (firstElement && firstElement->hasTagName(formTag))
m_form = static_cast<HTMLFormElement*>(firstElement);
- else
- m_form = form;
} else
m_form = element->findFormAncestor();
if (m_form)
@@ -160,7 +164,7 @@
form()->registerFormElement(this);
element->document()->unregisterFormElementWithFormAttribute(this);
} else
- resetFormOwner(0);
+ resetFormOwner();
}
const HTMLElement* toHTMLElement(const FormAssociatedElement* associatedElement)
Modified: trunk/Source/WebCore/html/FormAssociatedElement.h (91047 => 91048)
--- trunk/Source/WebCore/html/FormAssociatedElement.h 2011-07-15 04:31:28 UTC (rev 91047)
+++ trunk/Source/WebCore/html/FormAssociatedElement.h 2011-07-15 04:36:29 UTC (rev 91048)
@@ -55,7 +55,7 @@
virtual void formDestroyed() { m_form = 0; }
- void resetFormOwner(HTMLFormElement*);
+ void resetFormOwner();
protected:
FormAssociatedElement(HTMLFormElement*);
Modified: trunk/Source/WebCore/html/HTMLFormElement.cpp (91047 => 91048)
--- trunk/Source/WebCore/html/HTMLFormElement.cpp 2011-07-15 04:31:28 UTC (rev 91047)
+++ trunk/Source/WebCore/html/HTMLFormElement.cpp 2011-07-15 04:36:29 UTC (rev 91048)
@@ -138,7 +138,7 @@
HTMLElement::insertedIntoDocument();
if (hasID())
- document()->resetFormElementsOwner(this);
+ document()->resetFormElementsOwner();
}
void HTMLFormElement::removedFromDocument()
@@ -149,7 +149,7 @@
HTMLElement::removedFromDocument();
if (hasID())
- document()->resetFormElementsOwner(0);
+ document()->resetFormElementsOwner();
}
void HTMLFormElement::handleLocalEvents(Event* event)
