- Revision
- 144128
- Author
- ad...@chromium.org
- Date
- 2013-02-26 17:05:07 -0800 (Tue, 26 Feb 2013)
Log Message
Parsing of HTML tags in MathML Text Insertion Points leads to bogus parser behavior
https://bugs.webkit.org/show_bug.cgi?id=110808
Reviewed by Adam Barth.
Source/WebCore:
When looking for various table tags in the HTMLElementStack, compare
QualifiedNames rather than just local names, where necessary.
Note that not all uses have been "fixed"; I've only changed for which
I could write a test with differing behavior. A followup patch to
rationalize the use of QualifiedName vs local names would be ideal.
Tests: html5lib/generated/run-math-data.html
html5lib/generated/run-math-write.html
* html/parser/HTMLElementStack.cpp:
(WebCore::inScopeCommon): Added a version of inScopeCommon that
handles QualifiedNames instead of just localNames.
(WebCore::HTMLElementStack::inTableScope): When given a QualifiedName,
call the new version of inScopeCommon().
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::processStartTag):
(WebCore::HTMLTreeBuilder::processEndTagForInTableBody):
(WebCore::HTMLTreeBuilder::processTrEndTagForInRow):
LayoutTests:
* html5lib/generated/run-math-data-expected.txt: Added.
* html5lib/generated/run-math-data.html: Added.
* html5lib/generated/run-math-write-expected.txt: Added.
* html5lib/generated/run-math-write.html: Added.
* html5lib/resources/math.dat: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (144127 => 144128)
--- trunk/LayoutTests/ChangeLog 2013-02-27 01:01:19 UTC (rev 144127)
+++ trunk/LayoutTests/ChangeLog 2013-02-27 01:05:07 UTC (rev 144128)
@@ -1,3 +1,16 @@
+2013-02-26 Adam Klein <ad...@chromium.org>
+
+ Parsing of HTML tags in MathML Text Insertion Points leads to bogus parser behavior
+ https://bugs.webkit.org/show_bug.cgi?id=110808
+
+ Reviewed by Adam Barth.
+
+ * html5lib/generated/run-math-data-expected.txt: Added.
+ * html5lib/generated/run-math-data.html: Added.
+ * html5lib/generated/run-math-write-expected.txt: Added.
+ * html5lib/generated/run-math-write.html: Added.
+ * html5lib/resources/math.dat: Added.
+
2013-02-26 Kaustubh Atrawalkar <kaust...@motorola.com>
Notification.requestPermission callback should be optional
Added: trunk/LayoutTests/html5lib/generated/run-math-data-expected.txt (0 => 144128)
--- trunk/LayoutTests/html5lib/generated/run-math-data-expected.txt (rev 0)
+++ trunk/LayoutTests/html5lib/generated/run-math-data-expected.txt 2013-02-27 01:05:07 UTC (rev 144128)
@@ -0,0 +1 @@
+../resources/math.dat: PASS
Added: trunk/LayoutTests/html5lib/generated/run-math-data.html (0 => 144128)
--- trunk/LayoutTests/html5lib/generated/run-math-data.html (rev 0)
+++ trunk/LayoutTests/html5lib/generated/run-math-data.html 2013-02-27 01:05:07 UTC (rev 144128)
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<script>
+var test_files = [ '../resources/math.dat' ]
+</script>
+<script src=""
+<script>window.forceDataURLs = true;</script>
+<script src=""
Added: trunk/LayoutTests/html5lib/generated/run-math-write-expected.txt (0 => 144128)
--- trunk/LayoutTests/html5lib/generated/run-math-write-expected.txt (rev 0)
+++ trunk/LayoutTests/html5lib/generated/run-math-write-expected.txt 2013-02-27 01:05:07 UTC (rev 144128)
@@ -0,0 +1 @@
+../resources/math.dat: PASS
Added: trunk/LayoutTests/html5lib/generated/run-math-write.html (0 => 144128)
--- trunk/LayoutTests/html5lib/generated/run-math-write.html (rev 0)
+++ trunk/LayoutTests/html5lib/generated/run-math-write.html 2013-02-27 01:05:07 UTC (rev 144128)
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<script>
+var test_files = [ '../resources/math.dat' ]
+</script>
+<script src=""
+
+<script src=""
Added: trunk/LayoutTests/html5lib/resources/math.dat (0 => 144128)
--- trunk/LayoutTests/html5lib/resources/math.dat (rev 0)
+++ trunk/LayoutTests/html5lib/resources/math.dat 2013-02-27 01:05:07 UTC (rev 144128)
@@ -0,0 +1,81 @@
+#data
+<math><tr><td><mo><tr>
+#errors
+#document-fragment
+td
+#document
+| <math math>
+| <math tr>
+| <math td>
+| <math mo>
+
+#data
+<math><tr><td><mo><tr>
+#errors
+#document-fragment
+tr
+#document
+| <math math>
+| <math tr>
+| <math td>
+| <math mo>
+
+#data
+<math><thead><mo><tbody>
+#errors
+#document-fragment
+thead
+#document
+| <math math>
+| <math thead>
+| <math mo>
+
+#data
+<math><tfoot><mo><tbody>
+#errors
+#document-fragment
+tfoot
+#document
+| <math math>
+| <math tfoot>
+| <math mo>
+
+#data
+<math><tbody><mo><tfoot>
+#errors
+#document-fragment
+tbody
+#document
+| <math math>
+| <math tbody>
+| <math mo>
+
+#data
+<math><tbody><mo></table>
+#errors
+#document-fragment
+tbody
+#document
+| <math math>
+| <math tbody>
+| <math mo>
+
+#data
+<math><thead><mo></table>
+#errors
+#document-fragment
+tbody
+#document
+| <math math>
+| <math thead>
+| <math mo>
+
+#data
+<math><tfoot><mo></table>
+#errors
+#document-fragment
+tbody
+#document
+| <math math>
+| <math tfoot>
+| <math mo>
Modified: trunk/Source/WebCore/ChangeLog (144127 => 144128)
--- trunk/Source/WebCore/ChangeLog 2013-02-27 01:01:19 UTC (rev 144127)
+++ trunk/Source/WebCore/ChangeLog 2013-02-27 01:05:07 UTC (rev 144128)
@@ -1,3 +1,30 @@
+2013-02-26 Adam Klein <ad...@chromium.org>
+
+ Parsing of HTML tags in MathML Text Insertion Points leads to bogus parser behavior
+ https://bugs.webkit.org/show_bug.cgi?id=110808
+
+ Reviewed by Adam Barth.
+
+ When looking for various table tags in the HTMLElementStack, compare
+ QualifiedNames rather than just local names, where necessary.
+
+ Note that not all uses have been "fixed"; I've only changed for which
+ I could write a test with differing behavior. A followup patch to
+ rationalize the use of QualifiedName vs local names would be ideal.
+
+ Tests: html5lib/generated/run-math-data.html
+ html5lib/generated/run-math-write.html
+
+ * html/parser/HTMLElementStack.cpp:
+ (WebCore::inScopeCommon): Added a version of inScopeCommon that
+ handles QualifiedNames instead of just localNames.
+ (WebCore::HTMLElementStack::inTableScope): When given a QualifiedName,
+ call the new version of inScopeCommon().
+ * html/parser/HTMLTreeBuilder.cpp:
+ (WebCore::HTMLTreeBuilder::processStartTag):
+ (WebCore::HTMLTreeBuilder::processEndTagForInTableBody):
+ (WebCore::HTMLTreeBuilder::processTrEndTagForInRow):
+
2013-02-26 Kaustubh Atrawalkar <kaust...@motorola.com>
Notification.requestPermission callback should be optional
Modified: trunk/Source/WebCore/html/parser/HTMLElementStack.cpp (144127 => 144128)
--- trunk/Source/WebCore/html/parser/HTMLElementStack.cpp 2013-02-27 01:01:19 UTC (rev 144127)
+++ trunk/Source/WebCore/html/parser/HTMLElementStack.cpp 2013-02-27 01:05:07 UTC (rev 144128)
@@ -459,6 +459,20 @@
return false;
}
+template <bool isMarker(HTMLStackItem*)>
+bool inScopeCommon(HTMLElementStack::ElementRecord* top, const QualifiedName& targetTag)
+{
+ for (HTMLElementStack::ElementRecord* pos = top; pos; pos = pos->next()) {
+ HTMLStackItem* item = pos->stackItem().get();
+ if (item->hasTagName(targetTag))
+ return true;
+ if (isMarker(item))
+ return false;
+ }
+ ASSERT_NOT_REACHED(); // <html> is always on the stack and is a scope marker.
+ return false;
+}
+
bool HTMLElementStack::hasNumberedHeaderElementInScope() const
{
for (ElementRecord* record = m_top.get(); record; record = record->next()) {
@@ -514,8 +528,7 @@
bool HTMLElementStack::inTableScope(const QualifiedName& tagName) const
{
- // FIXME: Is localName() right for non-html elements?
- return inTableScope(tagName.localName());
+ return inScopeCommon<isTableScopeMarker>(m_top.get(), tagName);
}
bool HTMLElementStack::inButtonScope(const AtomicString& targetTag) const
Modified: trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp (144127 => 144128)
--- trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2013-02-27 01:01:19 UTC (rev 144127)
+++ trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp 2013-02-27 01:05:07 UTC (rev 144128)
@@ -1234,7 +1234,7 @@
}
if (isCaptionColOrColgroupTag(token->name()) || isTableBodyContextTag(token->name())) {
// FIXME: This is slow.
- if (!m_tree.openElements()->inTableScope(tbodyTag.localName()) && !m_tree.openElements()->inTableScope(theadTag.localName()) && !m_tree.openElements()->inTableScope(tfootTag.localName())) {
+ if (!m_tree.openElements()->inTableScope(tbodyTag) && !m_tree.openElements()->inTableScope(theadTag) && !m_tree.openElements()->inTableScope(tfootTag)) {
ASSERT(isParsingFragmentOrTemplateContents());
parseError(token);
return;
@@ -1723,7 +1723,7 @@
}
if (token->name() == tableTag) {
// FIXME: This is slow.
- if (!m_tree.openElements()->inTableScope(tbodyTag.localName()) && !m_tree.openElements()->inTableScope(theadTag.localName()) && !m_tree.openElements()->inTableScope(tfootTag.localName())) {
+ if (!m_tree.openElements()->inTableScope(tbodyTag) && !m_tree.openElements()->inTableScope(theadTag) && !m_tree.openElements()->inTableScope(tfootTag)) {
ASSERT(isParsingFragmentOrTemplateContents());
parseError(token);
return;
@@ -1978,7 +1978,7 @@
bool HTMLTreeBuilder::processTrEndTagForInRow()
{
- if (!m_tree.openElements()->inTableScope(trTag.localName())) {
+ if (!m_tree.openElements()->inTableScope(trTag)) {
ASSERT(isParsingFragmentOrTemplateContents());
// FIXME: parse error
return false;
