[Match Spec] Form element pointer should not be updated w/in <template>

third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 14 matching lines @@
  */
 
 #include "core/html/parser/HTMLConstructionSite.h"
 
 #include "core/HTMLElementFactory.h"
 #include "core/HTMLNames.h"
 #include "core/dom/Comment.h"
 #include "core/dom/DocumentFragment.h"
 #include "core/dom/DocumentType.h"
 #include "core/dom/Element.h"
+#include "core/dom/ElementTraversal.h"
 #include "core/dom/ScriptLoader.h"
 #include "core/dom/TemplateContentDocumentFragment.h"
 #include "core/dom/Text.h"
 #include "core/frame/LocalFrame.h"
 #include "core/html/HTMLFormElement.h"
 #include "core/html/HTMLHtmlElement.h"
 #include "core/html/HTMLPlugInElement.h"
 #include "core/html/HTMLScriptElement.h"
 #include "core/html/HTMLTemplateElement.h"
 #include "core/html/parser/AtomicHTMLToken.h"
@@ skipping 272 matching lines @@
     : m_document(&document)
     , m_attachmentRoot(document)
     , m_parserContentPolicy(parserContentPolicy)
     , m_isParsingFragment(false)
     , m_redirectAttachToFosterParent(false)
     , m_inQuirksMode(document.inQuirksMode())
 {
     ASSERT(m_document->isHTMLDocument() || m_document->isXHTMLDocument());
 }
 
-void HTMLConstructionSite::initFragmentParsing(DocumentFragment* fragment)
+void HTMLConstructionSite::initFragmentParsing(DocumentFragment* fragment, Element* contextElement)
 {
+    DCHECK(contextElement);
     DCHECK_EQ(m_document, &fragment->document());
     DCHECK_EQ(m_inQuirksMode, fragment->document().inQuirksMode());
     DCHECK(!m_isParsingFragment);
+    DCHECK(!m_form);
 
     m_attachmentRoot = fragment;
     m_isParsingFragment = true;
+
+    if (!contextElement->document().isTemplateDocument())
+        m_form = Traversal<HTMLFormElement>::firstAncestorOrSelf(*contextElement);
 }
 
 HTMLConstructionSite::~HTMLConstructionSite()
 {
     // Depending on why we're being destroyed it might be OK
     // to forget queued tasks, but currently we don't expect to.
     ASSERT(m_taskQueue.isEmpty());
     // Currently we assume that text will never be the last token in the
     // document and that we'll always queue some additional task to cause it to flush.
     ASSERT(m_pendingText.isEmpty());
@@ skipping 14 matching lines @@
 void HTMLConstructionSite::detach()
 {
     // FIXME: We'd like to ASSERT here that we're canceling and not just discarding
     // text that really should have made it into the DOM earlier, but there
     // doesn't seem to be a nice way to do that.
     m_pendingText.discard();
     m_document = nullptr;
     m_attachmentRoot = nullptr;
 }
 
-void HTMLConstructionSite::setForm(HTMLFormElement* form)
-{
-    // This method should only be needed for HTMLTreeBuilder in the fragment case.
-    ASSERT(!m_form);
-    m_form = form;
-}
-
 HTMLFormElement* HTMLConstructionSite::takeForm()
 {
     return m_form.release();
 }
 
 void HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML(AtomicHTMLToken* token)
 {
     ASSERT(m_document);
     HTMLHtmlElement* element = HTMLHtmlElement::create(*m_document);
     setAttributes(element, token, m_parserContentPolicy);
@@ skipping 207 matching lines @@
     attachLater(currentNode(), body);
     m_openElements.pushHTMLBodyElement(HTMLStackItem::create(body, token));
     if (m_document)
         m_document->willInsertBody();
 }
 
 void HTMLConstructionSite::insertHTMLFormElement(AtomicHTMLToken* token, bool isDemoted)
 {
     HTMLElement* element = createHTMLElement(token);
     ASSERT(isHTMLFormElement(element));
-    m_form = toHTMLFormElement(element);
-    m_form->setDemoted(isDemoted);
-    attachLater(currentNode(), m_form.get());
-    m_openElements.push(HTMLStackItem::create(m_form.get(), token));
+    HTMLFormElement* formElement = toHTMLFormElement(element);
+    if (!ownerDocumentForCurrentNode().isTemplateDocument())
+        m_form = formElement;
+    formElement->setDemoted(isDemoted);
+    attachLater(currentNode(), formElement);
+    m_openElements.push(HTMLStackItem::create(formElement, token));
 }
 
 void HTMLConstructionSite::insertHTMLElement(AtomicHTMLToken* token)
 {
     HTMLElement* element = createHTMLElement(token);
     attachLater(currentNode(), element);
     m_openElements.push(HTMLStackItem::create(element, token));
 }
 
 void HTMLConstructionSite::insertSelfClosingHTMLElementDestroyingToken(AtomicHTMLToken* token)
@@ skipping 127 matching lines @@
     if (isHTMLTemplateElement(*currentNode()))
         return toHTMLTemplateElement(currentElement())->content()->document();
     return currentNode()->document();
 }
 
 HTMLElement* HTMLConstructionSite::createHTMLElement(AtomicHTMLToken* token)
 {
     Document& document = ownerDocumentForCurrentNode();
     // Only associate the element with the current form if we're creating the new element
     // in a document with a browsing context (rather than in <template> contents).
-    HTMLFormElement* form = document.frame() ? m_form.get() : 0;
+    HTMLFormElement* form = document.frame() ? m_form.get() : nullptr;
     // FIXME: This can't use HTMLConstructionSite::createElement because we
     // have to pass the current form element.  We should rework form association
     // to occur after construction to allow better code sharing here.
     HTMLElement* element = HTMLElementFactory::createHTMLElement(token->name(), document, form, getCreateElementFlags());
     setAttributes(element, token, m_parserContentPolicy);
     return element;
 }
 
 HTMLStackItem* HTMLConstructionSite::createElementFromSavedToken(HTMLStackItem* item)
 {
@@ skipping 109 matching lines @@
     queueTask(task);
 }
 
 DEFINE_TRACE(HTMLConstructionSite::PendingText)
 {
     visitor->trace(parent);
     visitor->trace(nextChild);
 }
 
 } // namespace blink