[Match Spec] Form element pointer should not be updated w/in <template>

third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  * Copyright (C) 2011, 2014 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 20 matching lines @@
 #include "core/MathMLNames.h"
 #include "core/SVGNames.h"
 #include "core/XLinkNames.h"
 #include "core/XMLNSNames.h"
 #include "core/XMLNames.h"
 #include "core/dom/DocumentFragment.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/frame/UseCounter.h"
 #include "core/html/HTMLDocument.h"
 #include "core/html/HTMLFormElement.h"
+#include "core/html/HTMLTemplateElement.h"
 #include "core/html/parser/AtomicHTMLToken.h"
 #include "core/html/parser/HTMLDocumentParser.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/html/parser/HTMLStackItem.h"
 #include "core/html/parser/HTMLToken.h"
 #include "core/html/parser/HTMLTokenizer.h"
 #include "platform/text/PlatformLocale.h"
 #include "wtf/text/CharacterNames.h"
 #include <memory>
 
@@ skipping 75 matching lines @@
     return tagName == nobrTag
         || isNonAnchorNonNobrFormattingTag(tagName);
 }
 
 // http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#formatting
 static bool isFormattingTag(const AtomicString& tagName)
 {
     return tagName == aTag || isNonAnchorFormattingTag(tagName);
 }
 
-static HTMLFormElement* closestFormAncestor(Element& element)
-{
-    ASSERT(isMainThread());
-    return Traversal<HTMLFormElement>::firstAncestorOrSelf(element);
-}
-
 class HTMLTreeBuilder::CharacterTokenBuffer {
     WTF_MAKE_NONCOPYABLE(CharacterTokenBuffer);
 public:
     explicit CharacterTokenBuffer(AtomicHTMLToken* token)
         : m_characters(token->characters().impl())
         , m_current(0)
         , m_end(token->characters().length())
     {
         ASSERT(!isEmpty());
     }
@@ skipping 128 matching lines @@
     , m_scriptToProcessStartPosition(uninitializedPositionValue1())
     , m_options(options)
 {
 }
 
 HTMLTreeBuilder::HTMLTreeBuilder(HTMLDocumentParser* parser, DocumentFragment* fragment, Element* contextElement, ParserContentPolicy parserContentPolicy, const HTMLParserOptions& options)
     : HTMLTreeBuilder(parser, fragment->document(), parserContentPolicy, options)
 {
     ASSERT(isMainThread());
     ASSERT(contextElement);
-    m_tree.initFragmentParsing(fragment);
+    m_tree.initFragmentParsing(fragment, contextElement);
     m_fragmentContext.init(fragment, contextElement);
 
     // Steps 4.2-4.6 of the HTML5 Fragment Case parsing algorithm:
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-end.html#fragment-case
     // For efficiency, we skip step 4.2 ("Let root be a new html element with no attributes")
     // and instead use the DocumentFragment as a root node.
     m_tree.openElements()->pushRootNode(HTMLStackItem::create(fragment, HTMLStackItem::ItemForDocumentFragmentNode));
 
     if (isHTMLTemplateElement(*contextElement))
         m_templateInsertionModes.append(TemplateContentsMode);
 
     resetInsertionModeAppropriately();
-    m_tree.setForm(closestFormAncestor(*contextElement));
 }
 
 HTMLTreeBuilder::~HTMLTreeBuilder()
 {
 }
 
 void HTMLTreeBuilder::FragmentParsingContext::init(DocumentFragment* fragment, Element* contextElement)
 {
     DCHECK(fragment);
     DCHECK(!fragment->hasChildren());
@@ skipping 353 matching lines @@
         return;
     }
     if (token->name() == preTag || token->name() == listingTag) {
         processFakePEndTagIfPInButtonScope();
         m_tree.insertHTMLElement(token);
         m_shouldSkipLeadingNewline = true;
         m_framesetOk = false;
         return;
     }
     if (token->name() == formTag) {
-        if (m_tree.form()) {
+        if (m_tree.isFormElementPointerNonNull() && !isParsingTemplateContents()) {
             parseError(token);
             return;
         }
         processFakePEndTagIfPInButtonScope();
         m_tree.insertHTMLFormElement(token);
         return;
     }
     if (token->name() == liTag) {
         processCloseWhenNestedTag<isLi>(token);
         return;
@@ skipping 344 matching lines @@
         Attribute* typeAttribute = token->getAttributeItem(typeAttr);
         if (typeAttribute && equalIgnoringCase(typeAttribute->value(), "hidden")) {
             parseError(token);
             m_tree.insertSelfClosingHTMLElementDestroyingToken(token);
             return;
         }
         // Fall through to "anything else" case.
     }
     if (token->name() == formTag) {
         parseError(token);
-        if (m_tree.form())
+        if (m_tree.isFormElementPointerNonNull() && !isParsingTemplateContents())
             return;
         m_tree.insertHTMLFormElement(token, true);
         m_tree.openElements()->pop();
         return;
     }
     if (token->name() == templateTag) {
         processTemplateStartTag(token);
         return;
     }
     parseError(token);
@@ skipping 731 matching lines @@
         if (!m_tree.openElements()->inScope(token->name())) {
             parseError(token);
             return;
         }
         m_tree.generateImpliedEndTags();
         if (!m_tree.currentStackItem()->matchesHTMLTag(token->name()))
             parseError(token);
         m_tree.openElements()->popUntilPopped(token->name());
         return;
     }
-    if (token->name() == formTag) {
+    if (token->name() == formTag && !isParsingTemplateContents()) {
         Element* node = m_tree.takeForm();
         if (!node || !m_tree.openElements()->inScope(node)) {
             parseError(token);
             return;
         }
         m_tree.generateImpliedEndTags();
         if (m_tree.currentElement() != node)
             parseError(token);
         m_tree.openElements()->remove(node);
     }
@@ skipping 997 matching lines @@
     ASSERT(m_isAttached);
     // Warning, this may detach the parser. Do not do anything else after this.
     m_tree.finishedParsing();
 }
 
 void HTMLTreeBuilder::parseError(AtomicHTMLToken*)
 {
 }
 
 } // namespace blink