Source/WebCore/ChangeLog

 12019-11-06 Said Abou-Hallawa <sabouhallawa@apple.com>
 2
 3 Parsing HTML fragments assigns a wrong namespace if the parents is an SVG <foreignObject>
 4 https://bugs.webkit.org/show_bug.cgi?id=203868
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 Ensure that we don't cross boundaries from HTML to SVG when traversing
 9 the tree of nodes upward. We need to stop at the foreignObject if it is
 10 one of the ancestors of the contextElement.
 11
 12 Tests: svg/foreignObject/foreign-object-dynamic-parsing.svg
 13
 14 * xml/parser/XMLDocumentParser.cpp:
 15 (WebCore::XMLDocumentParser::parseDocumentFragment):
 16 * xml/parser/XMLDocumentParser.h:
 17 * xml/parser/XMLDocumentParserLibxml2.cpp:
 18 (WebCore::XMLDocumentParser::XMLDocumentParser):
 19
1202019-11-06 Oriol Brufau <obrufau@igalia.com>
221
322 Keep None value at the end of the ListStyleType enum
252154

Source/WebCore/xml/parser/XMLDocumentParser.cpp

4343#include "ResourceError.h"
4444#include "ResourceRequest.h"
4545#include "ResourceResponse.h"
 46#include "SVGForeignObjectElement.h"
4647#include "SVGNames.h"
4748#include "SVGStyleElement.h"
4849#include "ScriptElement.h"

@@bool XMLDocumentParser::parseDocumentFra
269270 return true;
270271 }
271272
272  auto parser = XMLDocumentParser::create(fragment, contextElement, parserContentPolicy);
 273 HashMap<AtomString, AtomString> prefixToNamespaceMap;
 274 AtomString defaultNamespaceURI;
 275 AtomString rootNamespaceURI;
 276
 277 for (auto* ancestor = contextElement; ancestor && !is<SVGForeignObjectElement>(ancestor); ancestor = ancestor->parentElement()) {
 278 rootNamespaceURI = ancestor->namespaceURI();
 279
 280 if (!ancestor->hasAttributes())
 281 continue;
 282
 283 for (const Attribute& attribute : ancestor->attributesIterator()) {
 284 if (attribute.prefix() == xmlnsAtom())
 285 prefixToNamespaceMap.set(attribute.localName(), attribute.value());
 286 else if (attribute.localName() == xmlnsAtom() && defaultNamespaceURI.isNull())
 287 defaultNamespaceURI = attribute.value();
 288 }
 289 }
 290
 291 if (defaultNamespaceURI.isNull())
 292 defaultNamespaceURI = rootNamespaceURI;
 293
 294 auto parser = XMLDocumentParser::create(fragment, WTFMove(prefixToNamespaceMap), defaultNamespaceURI, parserContentPolicy);
273295 bool wellFormed = parser->appendFragmentSource(chunk);
274296 // Do not call finish(). The finish() and doEnd() implementations touch the main document and loader and can cause crashes in the fragment case.
275297 parser->detach(); // Allows ~DocumentParser to assert it was detached before destruction.
252140

Source/WebCore/xml/parser/XMLDocumentParser.h

@@public:
6767 {
6868 return adoptRef(*new XMLDocumentParser(document, view));
6969 }
70  static Ref<XMLDocumentParser> create(DocumentFragment& fragment, Element* element, ParserContentPolicy parserContentPolicy)
 70 static Ref<XMLDocumentParser> create(DocumentFragment& fragment, HashMap<AtomString, AtomString>&& prefixToNamespaceMap, const AtomString& defaultNamespaceURI, ParserContentPolicy parserContentPolicy)
7171 {
72  return adoptRef(*new XMLDocumentParser(fragment, element, parserContentPolicy));
 72 return adoptRef(*new XMLDocumentParser(fragment, WTFMove(prefixToNamespaceMap), defaultNamespaceURI, parserContentPolicy));
7373 }
7474
7575 ~XMLDocumentParser();

@@public:
8989
9090private:
9191 explicit XMLDocumentParser(Document&, FrameView* = nullptr);
92  XMLDocumentParser(DocumentFragment&, Element*, ParserContentPolicy);
 92 XMLDocumentParser(DocumentFragment&, HashMap<AtomString, AtomString>&&, const AtomString&, ParserContentPolicy);
9393
9494 void insert(SegmentedString&&) final;
9595 void append(RefPtr<StringImpl>&&) final;

@@private:
180180 TextPosition m_scriptStartPosition;
181181
182182 bool m_parsingFragment { false };
183  AtomString m_defaultNamespaceURI;
184183
185184 HashMap<AtomString, AtomString> m_prefixToNamespaceMap;
 185 AtomString m_defaultNamespaceURI;
 186
186187 SegmentedString m_pendingSrc;
187188};
188189
252140

Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp

@@XMLDocumentParser::XMLDocumentParser(Doc
571571{
572572}
573573
574 XMLDocumentParser::XMLDocumentParser(DocumentFragment& fragment, Element* parentElement, ParserContentPolicy parserContentPolicy)
 574XMLDocumentParser::XMLDocumentParser(DocumentFragment& fragment, HashMap<AtomString, AtomString>&& prefixToNamespaceMap, const AtomString& defaultNamespaceURI, ParserContentPolicy parserContentPolicy)
575575 : ScriptableDocumentParser(fragment.document(), parserContentPolicy)
576576 , m_pendingCallbacks(makeUnique<PendingCallbacks>())
577577 , m_currentNode(&fragment)
578578 , m_scriptStartPosition(TextPosition::belowRangePosition())
579579 , m_parsingFragment(true)
 580 , m_prefixToNamespaceMap(WTFMove(prefixToNamespaceMap))
 581 , m_defaultNamespaceURI(defaultNamespaceURI)
580582{
581583 fragment.ref();
582 
583  // Add namespaces based on the parent node
584  Vector<Element*> elemStack;
585  while (parentElement) {
586  elemStack.append(parentElement);
587 
588  ContainerNode* node = parentElement->parentNode();
589  if (!is<Element>(node))
590  break;
591  parentElement = downcast<Element>(node);
592  }
593 
594  if (elemStack.isEmpty())
595  return;
596 
597  // FIXME: Share code with isDefaultNamespace() per http://www.whatwg.org/specs/web-apps/current-work/multipage/the-xhtml-syntax.html#parsing-xhtml-fragments
598  for (; !elemStack.isEmpty(); elemStack.removeLast()) {
599  Element* element = elemStack.last();
600  if (element->hasAttributes()) {
601  for (const Attribute& attribute : element->attributesIterator()) {
602  if (attribute.localName() == xmlnsAtom())
603  m_defaultNamespaceURI = attribute.value();
604  else if (attribute.prefix() == xmlnsAtom())
605  m_prefixToNamespaceMap.set(attribute.localName(), attribute.value());
606  }
607  }
608  }
609 
610  if (m_defaultNamespaceURI.isNull())
611  m_defaultNamespaceURI = parentElement->namespaceURI();
612584}
613585
614586XMLParserContext::~XMLParserContext()
252140

LayoutTests/ChangeLog

 12019-11-06 Said Abou-Hallawa <sabouhallawa@apple.com>
 2
 3 Parsing HTML fragments assigns a wrong namespace if the parents is an SVG <foreignObject>
 4 https://bugs.webkit.org/show_bug.cgi?id=203868
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 * svg/foreignObject/foreign-object-dynamic-parsing-expected.svg: Added.
 9 * svg/foreignObject/foreign-object-dynamic-parsing.svg: Added.
 10
1112019-11-06 Daniel Bates <dabates@apple.com>
212
313 REGRESSION [ PHP ][ iOS ]: Two http/tests/cookies/same-site/set-first-party-* Tests are Failing
252140

LayoutTests/svg/foreignObject/foreign-object-dynamic-parsing-expected.svg

 1<svg xmlns="http://www.w3.org/2000/svg">
 2 <foreignObject x="10" width="200" height="100">
 3 <div xmlns="http://www.w3.org/1999/xhtml">
 4 <h2>Header</h2>
 5 <table style='border: 1px solid black;'>
 6 <thead>
 7 <tr>
 8 <th>Cell 1</th>
 9 <th>Cell 2</th>
 10 <th>Cell 3</th>
 11 </tr>
 12 </thead>
 13 </table>
 14 </div>
 15 </foreignObject>
 16</svg>
nonexistent

LayoutTests/svg/foreignObject/foreign-object-dynamic-parsing.svg

 1<svg xmlns="http://www.w3.org/2000/svg">
 2 <script><![CDATA[
 3 var xhtml_ns = "http://www.w3.org/1999/xhtml";
 4 var root = document.documentElement;
 5
 6 var foreignObject = document.createElementNS("http://www.w3.org/2000/svg", "foreignObject");
 7 foreignObject.setAttribute("x", "10");
 8 foreignObject.setAttribute("width", "200");
 9 foreignObject.setAttribute("height", "100");
 10 root.appendChild(foreignObject);
 11
 12 var log = document.createElementNS(xhtml_ns, "div");
 13 foreignObject.appendChild(log);
 14
 15 var html =
 16 "<h2>Header</h2>" +
 17 "<table style='border: 1px solid black;'>" +
 18 "<thead>" +
 19 "<tr>" +
 20 "<th>Cell 1</th>" +
 21 "<th>Cell 2</th>" +
 22 "<th>Cell 3</th>" +
 23 "</tr>" +
 24 "</thead>" +
 25 "</table>";
 26
 27 log.innerHTML = html;
 28 ]]></script>
 29</svg>
nonexistent