92838 2012-07-31 22:08:30 -0700 HTMLTreeBuilder passes a wrong token when pushing the head element 2012-08-01 16:03:27 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 92830 1 skyul skyul abarth eric webkit.review.bot oldest_to_newest 683872 0 skyul 2012-07-31 22:08:30 -0700 When the tree builder pushes the head element in the "after head" insertion mode, it creates a HTMLStackItem from a wrong token. Added HTMLConstructionSite::headStackItem() to retrieve the stack item for the head element. Modified the tree builder to pass the correct stack item when pushing the head element in the "after head" insertion mode. 683875 1 155720 skyul 2012-07-31 22:11:46 -0700 Created attachment 155720 Patch 684334 2 155720 abarth 2012-08-01 11:08:00 -0700 Comment on attachment 155720 Patch Interesting. It's hard to see how this could have any observable effects, but I agree that it's wrong. 684349 3 eric 2012-08-01 11:20:05 -0700 Maybe with one of those convoluted tests for token re-use, something like: <head a='b'> <script> document.head.setAttribute('a', 'c'); </script> But I agree with Adam and it's unlikely to matter. 684411 4 abarth 2012-08-01 11:54:14 -0700 > Maybe with one of those convoluted tests for token re-use, something like: Yeah, but I couldn't think of any cases where we'd read back the attributes of the <head> element... 684431 5 155720 webkit.review.bot 2012-08-01 12:03:31 -0700 Comment on attachment 155720 Patch Clearing flags on attachment: 155720 Committed r124353: <http://trac.webkit.org/changeset/124353> 684432 6 webkit.review.bot 2012-08-01 12:03:34 -0700 All reviewed patches have been landed. Closing bug. 684706 7 skyul 2012-08-01 16:03:27 -0700 (In reply to comment #4) > > Maybe with one of those convoluted tests for token re-use, something like: > > Yeah, but I couldn't think of any cases where we'd read back the attributes of the <head> element... It's hardly a problem in real situations. But the first assertion in HTMLElementStack::pushHTMLHeadElement(PassRefPtr<HTMLStackItem>) fails after Bug 92830. void HTMLElementStack::pushHTMLHeadElement(PassRefPtr<HTMLStackItem> item) { ASSERT(item->hasTagName(HTMLNames::headTag)); // <- this assertion fails because the tag name is read from the stack item (saved token). ASSERT(!m_headElement); m_headElement = item->element(); pushCommon(item); } 155720 2012-07-31 22:11:46 -0700 2012-08-01 12:03:30 -0700 Patch bug-92838-20120801141117.patch text/plain 4423 skyul U3VidmVyc2lvbiBSZXZpc2lvbjogMTI0MjgzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYmJlZGU2ZGUyZWQ3MzY3 OWQwYmFmNDc0NjQ3ZjNhZDgzYTI5YzZjNi4uY2YyNmZiMzNkNTkxM2U2MDM1ZjMyY2Q3M2ZiZmJm MmQ3Yjg3MDI5YyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI4IEBACisyMDEyLTA3LTMxICBLd2Fu ZyBZdWwgU2VvICA8c2t5dWxAY29tcGFueTEwMC5uZXQ+CisKKyAgICAgICAgSFRNTFRyZWVCdWls ZGVyIHBhc3NlcyBhIHdyb25nIHRva2VuIHdoZW4gcHVzaGluZyB0aGUgaGVhZCBlbGVtZW50Cisg ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05MjgzOAorCisg ICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFdoZW4gdGhlIHRy ZWUgYnVpbGRlciBwdXNoZXMgdGhlIGhlYWQgZWxlbWVudCBpbiB0aGUgImFmdGVyIGhlYWQiIGlu c2VydGlvbiBtb2RlLAorICAgICAgICBpdCBjcmVhdGVzIGEgSFRNTFN0YWNrSXRlbSBmcm9tIGEg d3JvbmcgdG9rZW4uCisKKyAgICAgICAgQWRkZWQgSFRNTENvbnN0cnVjdGlvblNpdGU6OmhlYWRT dGFja0l0ZW0oKSB0byByZXRyaWV2ZSB0aGUgc3RhY2sgaXRlbSBmb3IgdGhlIGhlYWQKKyAgICAg ICAgZWxlbWVudC4gTW9kaWZpZWQgdGhlIHRyZWUgYnVpbGRlciB0byBwYXNzIHRoZSBjb3JyZWN0 IHN0YWNrIGl0ZW0gd2hlbiBwdXNoaW5nIHRoZSBoZWFkCisgICAgICAgIGVsZW1lbnQgaW4gdGhl ICJhZnRlciBoZWFkIiBpbnNlcnRpb24gbW9kZS4KKworICAgICAgICBObyBuZXcgdGVzdHMsIGNv dmVyZWQgYnkgZXhpc3RpbmcgdGVzdHMuCisKKyAgICAgICAgKiBodG1sL3BhcnNlci9IVE1MQ29u c3RydWN0aW9uU2l0ZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpIVE1MQ29uc3RydWN0aW9uU2l0 ZTo6aW5zZXJ0SFRNTEhlYWRFbGVtZW50KToKKyAgICAgICAgKiBodG1sL3BhcnNlci9IVE1MQ29u c3RydWN0aW9uU2l0ZS5oOgorICAgICAgICAoV2ViQ29yZTo6SFRNTENvbnN0cnVjdGlvblNpdGU6 OmhlYWQpOgorICAgICAgICAoV2ViQ29yZTo6SFRNTENvbnN0cnVjdGlvblNpdGU6OmhlYWRTdGFj a0l0ZW0pOgorICAgICAgICAoSFRNTENvbnN0cnVjdGlvblNpdGUpOgorICAgICAgICAqIGh0bWwv cGFyc2VyL0hUTUxUcmVlQnVpbGRlci5jcHA6CisgICAgICAgIChXZWJDb3JlOjpIVE1MVHJlZUJ1 aWxkZXI6OnByb2Nlc3NTdGFydFRhZyk6CisKIDIwMTItMDctMzAgIFJ5b3N1a2UgTml3YSAgPHJu aXdhQHdlYmtpdC5vcmc+CiAKICAgICAgICAgUkVHUkVTU0lPTihyMTIwOTc5KTogTm9kZSBsaXN0 IHJldHVybmVkIGJ5IGdldEVsZW1lbnRzQnlUYWdOYW1lTlMgaXNuJ3QgaW52YWxpZGF0ZWQgd2hl biBjaGlsZHJlbiBjaGFuZ2VzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNl ci9IVE1MQ29uc3RydWN0aW9uU2l0ZS5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9I VE1MQ29uc3RydWN0aW9uU2l0ZS5jcHAKaW5kZXggNjI2Nzg3MjJjZDdlZmFmNjc4NWM0MDY0ZTI2 NTVjMzFmMDA2NzYyZS4uNDg2NWVmMTA4ZDViNDVhOWI5N2I1NWNlMzY4MWE0YjhiMTk3OTUyNyAx MDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvSFRNTENvbnN0cnVjdGlvblNp dGUuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL0hUTUxDb25zdHJ1Y3Rpb25T aXRlLmNwcApAQCAtMjc3LDkgKzI3Nyw5IEBAIHZvaWQgSFRNTENvbnN0cnVjdGlvblNpdGU6Omlu c2VydENvbW1lbnRPbkhUTUxIdG1sRWxlbWVudChBdG9taWNIVE1MVG9rZW4qIHRva2VuCiB2b2lk IEhUTUxDb25zdHJ1Y3Rpb25TaXRlOjppbnNlcnRIVE1MSGVhZEVsZW1lbnQoQXRvbWljSFRNTFRv a2VuKiB0b2tlbikKIHsKICAgICBBU1NFUlQoIXNob3VsZEZvc3RlclBhcmVudCgpKTsKLSAgICBt X2hlYWQgPSBjcmVhdGVIVE1MRWxlbWVudCh0b2tlbik7Ci0gICAgYXR0YWNoTGF0ZXIoY3VycmVu dE5vZGUoKSwgbV9oZWFkKTsKLSAgICBtX29wZW5FbGVtZW50cy5wdXNoSFRNTEhlYWRFbGVtZW50 KEhUTUxTdGFja0l0ZW06OmNyZWF0ZShtX2hlYWQsIHRva2VuKSk7CisgICAgbV9oZWFkID0gSFRN TFN0YWNrSXRlbTo6Y3JlYXRlKGNyZWF0ZUhUTUxFbGVtZW50KHRva2VuKSwgdG9rZW4pOworICAg IGF0dGFjaExhdGVyKGN1cnJlbnROb2RlKCksIG1faGVhZC0+ZWxlbWVudCgpKTsKKyAgICBtX29w ZW5FbGVtZW50cy5wdXNoSFRNTEhlYWRFbGVtZW50KG1faGVhZCk7CiB9CiAKIHZvaWQgSFRNTENv bnN0cnVjdGlvblNpdGU6Omluc2VydEhUTUxCb2R5RWxlbWVudChBdG9taWNIVE1MVG9rZW4qIHRv a2VuKQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvSFRNTENvbnN0cnVj dGlvblNpdGUuaCBiL1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL0hUTUxDb25zdHJ1Y3Rpb25T aXRlLmgKaW5kZXggOWJmMzFmMzI4ODljMTc5MmNmNTJhNGJjMzI4YzhlNjc1MTBlMTMyNy4uZWJk ZWMyY2Y0NTllMTViMDg2ZTNkOGFjMTkwZDA1NGJiY2U0ODJiZSAxMDA2NDQKLS0tIGEvU291cmNl L1dlYkNvcmUvaHRtbC9wYXJzZXIvSFRNTENvbnN0cnVjdGlvblNpdGUuaAorKysgYi9Tb3VyY2Uv V2ViQ29yZS9odG1sL3BhcnNlci9IVE1MQ29uc3RydWN0aW9uU2l0ZS5oCkBAIC0xMTksNyArMTE5 LDggQEAgcHVibGljOgogICAgIEhUTUxFbGVtZW50U3RhY2sqIG9wZW5FbGVtZW50cygpIGNvbnN0 IHsgcmV0dXJuICZtX29wZW5FbGVtZW50czsgfQogICAgIEhUTUxGb3JtYXR0aW5nRWxlbWVudExp c3QqIGFjdGl2ZUZvcm1hdHRpbmdFbGVtZW50cygpIGNvbnN0IHsgcmV0dXJuICZtX2FjdGl2ZUZv cm1hdHRpbmdFbGVtZW50czsgfQogCi0gICAgRWxlbWVudCogaGVhZCgpIGNvbnN0IHsgcmV0dXJu IG1faGVhZC5nZXQoKTsgfQorICAgIEVsZW1lbnQqIGhlYWQoKSBjb25zdCB7IHJldHVybiBtX2hl YWQtPmVsZW1lbnQoKTsgfQorICAgIEhUTUxTdGFja0l0ZW0qIGhlYWRTdGFja0l0ZW0oKSBjb25z dCB7IHJldHVybiBtX2hlYWQuZ2V0KCk7IH0KIAogICAgIHZvaWQgc2V0Rm9ybShIVE1MRm9ybUVs ZW1lbnQqKTsKICAgICBIVE1MRm9ybUVsZW1lbnQqIGZvcm0oKSBjb25zdCB7IHJldHVybiBtX2Zv cm0uZ2V0KCk7IH0KQEAgLTE2Niw3ICsxNjcsNyBAQCBwcml2YXRlOgogICAgIC8vIGFuZCBhIERv Y3VtZW50IGluIGFsbCBvdGhlciBjYXNlcy4KICAgICBDb250YWluZXJOb2RlKiBtX2F0dGFjaG1l bnRSb290OwogICAgIAotICAgIFJlZlB0cjxFbGVtZW50PiBtX2hlYWQ7CisgICAgUmVmUHRyPEhU TUxTdGFja0l0ZW0+IG1faGVhZDsKICAgICBSZWZQdHI8SFRNTEZvcm1FbGVtZW50PiBtX2Zvcm07 CiAgICAgbXV0YWJsZSBIVE1MRWxlbWVudFN0YWNrIG1fb3BlbkVsZW1lbnRzOwogICAgIG11dGFi bGUgSFRNTEZvcm1hdHRpbmdFbGVtZW50TGlzdCBtX2FjdGl2ZUZvcm1hdHRpbmdFbGVtZW50czsK ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvcGFyc2VyL0hUTUxUcmVlQnVpbGRlci5j cHAgYi9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9IVE1MVHJlZUJ1aWxkZXIuY3BwCmluZGV4 IDc3YzdhMDc3ZTA0MTAxMWIxOGMxNTFjZmZjM2Y1ZjFiNTJhY2JhN2IuLjdlZTJhNTQ3ZmFlMjY2 ZmVmZmRhZTdjZjFhZDg5OWM3MDA4MmU5MDUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2h0 bWwvcGFyc2VyL0hUTUxUcmVlQnVpbGRlci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvaHRtbC9w YXJzZXIvSFRNTFRyZWVCdWlsZGVyLmNwcApAQCAtMTE5MCw3ICsxMTkwLDcgQEAgdm9pZCBIVE1M VHJlZUJ1aWxkZXI6OnByb2Nlc3NTdGFydFRhZyhBdG9taWNIVE1MVG9rZW4qIHRva2VuKQogICAg ICAgICAgICAgfHwgdG9rZW4tPm5hbWUoKSA9PSB0aXRsZVRhZykgewogICAgICAgICAgICAgcGFy c2VFcnJvcih0b2tlbik7CiAgICAgICAgICAgICBBU1NFUlQobV90cmVlLmhlYWQoKSk7Ci0gICAg ICAgICAgICBtX3RyZWUub3BlbkVsZW1lbnRzKCktPnB1c2hIVE1MSGVhZEVsZW1lbnQoSFRNTFN0 YWNrSXRlbTo6Y3JlYXRlKG1fdHJlZS5oZWFkKCksIHRva2VuKSk7CisgICAgICAgICAgICBtX3Ry ZWUub3BlbkVsZW1lbnRzKCktPnB1c2hIVE1MSGVhZEVsZW1lbnQobV90cmVlLmhlYWRTdGFja0l0 ZW0oKSk7CiAgICAgICAgICAgICBwcm9jZXNzU3RhcnRUYWdGb3JJbkhlYWQodG9rZW4pOwogICAg ICAgICAgICAgbV90cmVlLm9wZW5FbGVtZW50cygpLT5yZW1vdmVIVE1MSGVhZEVsZW1lbnQobV90 cmVlLmhlYWQoKSk7CiAgICAgICAgICAgICByZXR1cm47Cg==