Source/WebCore/ChangeLog

 12019-11-05 Said Abou-Hallawa <sabouhallawa@apple.com>
 2
 3 Parsing HTML fragments assigns a wrong namespace if the parents is an SVG <foreignObject>
 4 https://bugs.webkit.org/show_bug.cgi?id=203868
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 Ensure that we don't cross boundaries from HTML to SVG when traversing
 9 the tree nodes upward. We need to stop at the foreignObject if it is one
 10 of the ancestors of the parent node.
 11
 12 Tests: svg/foreignObject/foreign-object-dynamic-parsing.svg
 13
 14 * xml/parser/XMLDocumentParserLibxml2.cpp:
 15 (WebCore::XMLDocumentParser::XMLDocumentParser):
 16
1172019-11-05 Fujii Hironori <Hironori.Fujii@sony.com>
218
319 [Win][CMake] Build WebCore as an OBJECT library unless Apple internal builds
252114

Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp

4444#include "ProcessingInstruction.h"
4545#include "ResourceError.h"
4646#include "ResourceResponse.h"
 47#include "SVGForeignObjectElement.h"
4748#include "ScriptElement.h"
4849#include "ScriptSourceCode.h"
4950#include "Settings.h"

@@XMLDocumentParser::XMLDocumentParser(Doc
580581{
581582 fragment.ref();
582583
583  // Add namespaces based on the parent node
584  Vector<Element*> elemStack;
585  while (parentElement) {
586  elemStack.append(parentElement);
587 
588  ContainerNode* node = parentElement->parentNode();
589  if (!is<Element>(node))
590  break;
591  parentElement = downcast<Element>(node);
 584 // Add namespaces based on the parent node. Don't cross boundaries from HTML to SVG.
 585 Vector<Ref<Element>> elemStack;
 586 while (parentElement && !is<SVGForeignObjectElement>(parentElement)) {
 587 elemStack.append(makeRef(*parentElement));
 588 parentElement = parentElement->parentElement();
592589 }
593590
594591 if (elemStack.isEmpty())
595592 return;
596593
597594 // FIXME: Share code with isDefaultNamespace() per http://www.whatwg.org/specs/web-apps/current-work/multipage/the-xhtml-syntax.html#parsing-xhtml-fragments
598  for (; !elemStack.isEmpty(); elemStack.removeLast()) {
599  Element* element = elemStack.last();
600  if (element->hasAttributes()) {
601  for (const Attribute& attribute : element->attributesIterator()) {
602  if (attribute.localName() == xmlnsAtom())
603  m_defaultNamespaceURI = attribute.value();
604  else if (attribute.prefix() == xmlnsAtom())
605  m_prefixToNamespaceMap.set(attribute.localName(), attribute.value());
606  }
 595 for (int i = elemStack.size(); i-- > 0; ) {
 596 auto& element = elemStack[i];
 597 if (!element->hasAttributes())
 598 continue;
 599
 600 for (const Attribute& attribute : element->attributesIterator()) {
 601 if (attribute.localName() == xmlnsAtom())
 602 m_defaultNamespaceURI = attribute.value();
 603 else if (attribute.prefix() == xmlnsAtom())
 604 m_prefixToNamespaceMap.set(attribute.localName(), attribute.value());
607605 }
608606 }
609607
610608 if (m_defaultNamespaceURI.isNull())
611  m_defaultNamespaceURI = parentElement->namespaceURI();
 609 m_defaultNamespaceURI = elemStack.last()->namespaceURI();
612610}
613611
614612XMLParserContext::~XMLParserContext()
252083

LayoutTests/ChangeLog

 12019-11-05 Said Abou-Hallawa <sabouhallawa@apple.com>
 2
 3 Parsing HTML fragments assigns a wrong namespace if the parents is an SVG <foreignObject>
 4 https://bugs.webkit.org/show_bug.cgi?id=203868
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 * svg/foreignObject/foreign-object-dynamic-parsing-expected.svg: Added.
 9 * svg/foreignObject/foreign-object-dynamic-parsing.svg: Added.
 10
1112019-11-05 Oriol Brufau <obrufau@igalia.com>
212
313 [css-lists] Implement list-style-type: <string>
252083

LayoutTests/svg/foreignObject/foreign-object-dynamic-parsing-expected.svg

 1<svg xmlns="http://www.w3.org/2000/svg">
 2 <foreignObject x="10" width="200" height="100">
 3 <div xmlns="http://www.w3.org/1999/xhtml">
 4 <h2>Header</h2>
 5 <table style='border: 1px solid black;'>
 6 <thead>
 7 <tr>
 8 <th>Cell 1</th>
 9 <th>Cell 2</th>
 10 <th>Cell 3</th>
 11 </tr>
 12 </thead>
 13 </table>
 14 </div>
 15 </foreignObject>
 16</svg>
nonexistent

LayoutTests/svg/foreignObject/foreign-object-dynamic-parsing.svg

 1<svg xmlns="http://www.w3.org/2000/svg">
 2 <script><![CDATA[
 3 var xhtml_ns = "http://www.w3.org/1999/xhtml";
 4 var root = document.documentElement;
 5
 6 var foreignObject = document.createElementNS("http://www.w3.org/2000/svg", "foreignObject");
 7 foreignObject.setAttribute("x", "10");
 8 foreignObject.setAttribute("width", "200");
 9 foreignObject.setAttribute("height", "100");
 10 root.appendChild(foreignObject);
 11
 12 var log = document.createElementNS(xhtml_ns, "div");
 13 foreignObject.appendChild(log);
 14
 15 var html =
 16 "<h2>Header</h2>" +
 17 "<table style='border: 1px solid black;'>" +
 18 "<thead>" +
 19 "<tr>" +
 20 "<th>Cell 1</th>" +
 21 "<th>Cell 2</th>" +
 22 "<th>Cell 3</th>" +
 23 "</tr>" +
 24 "</thead>" +
 25 "</table>";
 26
 27 log.innerHTML = html;
 28 ]]></script>
 29</svg>
nonexistent