ChangeLog

2019-11-05  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Parsing HTML fragments assigns a wrong namespace if the parents is an SVG <foreignObject>

        https://bugs.webkit.org/show_bug.cgi?id=203868

        Reviewed by NOBODY (OOPS!).

        Ensure that we don't cross boundaries from HTML to SVG when traversing

        the tree nodes upward. We need to stop at the foreignObject if it is one

        of the ancestors of the parent node.

        Tests: svg/foreignObject/foreign-object-dynamic-parsing.svg

        * xml/parser/XMLDocumentParserLibxml2.cpp:

        (WebCore::XMLDocumentParser::XMLDocumentParser):

2019-11-06  Chris Lord  <clord@igalia.com>

        [Cairo] Cairo graphics backend uses ImageBuffer::copyImage just to access native image buffer handles

252140

Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp

#include "ProcessingInstruction.h"

#include "ResourceError.h"

#include "ResourceResponse.h"

47#include "SVGForeignObjectElement.h"

#include "ScriptElement.h"

#include "ScriptSourceCode.h"

#include "Settings.h"

@@XMLDocumentParser::XMLDocumentParser(Doc

{

    fragment.ref();

    // Add namespaces based on the parent node

    Vector<Element*> elemStack;

    while (parentElement) {

        elemStack.append(parentElement);

584 AtomString defaultNamespaceURI;

587585

        ContainerNode* node = parentElement->parentNode();

        if (!is<Element>(node))

            break;

        parentElement = downcast<Element>(node);

    }

    if (elemStack.isEmpty())

        return;

    // FIXME: Share code with isDefaultNamespace() per http://www.whatwg.org/specs/web-apps/current-work/multipage/the-xhtml-syntax.html#parsing-xhtml-fragments

    for (; !elemStack.isEmpty(); elemStack.removeLast()) {

        Element* element = elemStack.last();

        if (element->hasAttributes()) {

            for (const Attribute& attribute : element->attributesIterator()) {

                if (attribute.localName() == xmlnsAtom())

                    m_defaultNamespaceURI = attribute.value();

                else if (attribute.prefix() == xmlnsAtom())

                    m_prefixToNamespaceMap.set(attribute.localName(), attribute.value());

    // Don't cross boundaries from HTML to SVG.

    for (auto* ancestor = parentElement; ancestor && !is<SVGForeignObjectElement>(ancestor); ancestor = ancestor->parentElement()) {

        defaultNamespaceURI = ancestor->namespaceURI();

        if (!ancestor->hasAttributes())

            continue;

        for (const Attribute& attribute : ancestor->attributesIterator()) {

            if (m_defaultNamespaceURI.isNull() && attribute.localName() == xmlnsAtom())

                m_defaultNamespaceURI = attribute.value();

            else if (attribute.prefix() == xmlnsAtom()) {

                m_prefixToNamespaceMap.ensure(xmlnsAtom(), [&] {

                    return attribute.value();

                });

606600 }

607601 }

        if (!m_defaultNamespaceURI.isNull() && m_prefixToNamespaceMap.contains(xmlnsAtom()))

            break;

    }

    if (m_defaultNamespaceURI.isNull())

611 m_defaultNamespaceURI = p~~arentElement->n~~amespaceURI();

608 m_defaultNamespaceURI = defaultNamespaceURI;

}

XMLParserContext::~XMLParserContext()

252140

LayoutTests/ChangeLog

2019-11-05  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Parsing HTML fragments assigns a wrong namespace if the parents is an SVG <foreignObject>

        https://bugs.webkit.org/show_bug.cgi?id=203868

        Reviewed by NOBODY (OOPS!).

        * svg/foreignObject/foreign-object-dynamic-parsing-expected.svg: Added.

        * svg/foreignObject/foreign-object-dynamic-parsing.svg: Added.

2019-11-06  Daniel Bates  <dabates@apple.com>

        REGRESSION [ PHP ][ iOS ]: Two http/tests/cookies/same-site/set-first-party-* Tests are Failing

252140

LayoutTests/svg/foreignObject/foreign-object-dynamic-parsing-expected.svg

<svg xmlns="http://www.w3.org/2000/svg">

    <foreignObject x="10" width="200" height="100">

        <div xmlns="http://www.w3.org/1999/xhtml">

            <h2>Header</h2>

            <table style='border: 1px solid black;'>

                <thead>

                    <tr>

                        <th>Cell 1</th>

                        <th>Cell 2</th>

                        <th>Cell 3</th>

                    </tr>

                </thead>

            </table>

        </div>

    </foreignObject>

</svg>

nonexistent

LayoutTests/svg/foreignObject/foreign-object-dynamic-parsing.svg

<svg xmlns="http://www.w3.org/2000/svg">

    <script><![CDATA[

        var xhtml_ns = "http://www.w3.org/1999/xhtml";

        var root = document.documentElement;

        var foreignObject = document.createElementNS("http://www.w3.org/2000/svg", "foreignObject");

        foreignObject.setAttribute("x", "10");

        foreignObject.setAttribute("width", "200");

        foreignObject.setAttribute("height", "100");

        root.appendChild(foreignObject);

        var log = document.createElementNS(xhtml_ns, "div");

        foreignObject.appendChild(log);

        var html =

            "<h2>Header</h2>" + 

            "<table style='border: 1px solid black;'>" +

                "<thead>" +

                    "<tr>" +

                        "<th>Cell 1</th>" +

                        "<th>Cell 2</th>" +

                        "<th>Cell 3</th>" +

                    "</tr>" +

                "</thead>" +

            "</table>";

        log.innerHTML = html;

    ]]></script>

</svg>

nonexistent