Bug 104142 - [HTMLTemplateElement] Prevent first-level recursive <template> from resetting the implied context
Summary: [HTMLTemplateElement] Prevent first-level recursive <template> from resetting...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Adam Klein
URL:
Keywords:
Depends on:
Blocks: 103547
  Show dependency treegraph
 
Reported: 2012-12-05 11:06 PST by Rafael Weinstein
Modified: 2012-12-18 13:47 PST (History)
8 users (show)

See Also:


Attachments
Patch (6.62 KB, patch)
2012-12-05 11:09 PST, Rafael Weinstein
no flags Details | Formatted Diff | Diff
Patch (7.90 KB, patch)
2012-12-06 15:45 PST, Adam Klein
no flags Details | Formatted Diff | Diff
Patch with better ASSERTs (8.81 KB, patch)
2012-12-14 14:02 PST, Adam Klein
no flags Details | Formatted Diff | Diff
Patch for landing (8.78 KB, patch)
2012-12-18 12:28 PST, Adam Klein
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Rafael Weinstein 2012-12-05 11:06:13 PST
Hey guys,

Here's my take on resolving: https://www.w3.org/Bugs/Public/show_bug.cgi?id=20130

Is this a reasonable approach? If so, I'll update the spec, refer to it in this patch, then request formal review.
Comment 1 Rafael Weinstein 2012-12-05 11:09:29 PST
Created attachment 177796 [details]
Patch
Comment 2 Adam Barth 2012-12-05 18:00:42 PST
Comment on attachment 177796 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=177796&action=review

> Source/WebCore/ChangeLog:8
> +        This patch adds a "stack" (although the impl is just a map) which allows for retaining the chosen "implied context" for each template element.

I see, it is just a stack.  Is there a reason you used a HashMap rather than a Vector to implement the stack?  A Vector seems both more efficient and to be a clearer representation of a stack.

> Source/WebCore/html/parser/HTMLTreeBuilder.h:237
> +#if ENABLE(TEMPLATE_ELEMENT)
> +    HashMap<Element*, InsertionMode> m_templateInsertionModes;
> +#endif

Interesting!  Does this need to be a hashmap?  I would have expected just a Vector<InsertionMode> that we'd push and pop in parallel with the stack of open elements.  (We can overwrite the top of the stack in processStartTag.
Comment 3 Adam Barth 2012-12-05 18:01:20 PST
Yeah, this looks like a good way to resolve this issue (modulo implementation details).
Comment 4 Adam Klein 2012-12-06 15:45:57 PST
Created attachment 178095 [details]
Patch
Comment 5 Adam Klein 2012-12-06 15:46:36 PST
(In reply to comment #2)
> (From update of attachment 177796 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=177796&action=review
> 
> > Source/WebCore/ChangeLog:8
> > +        This patch adds a "stack" (although the impl is just a map) which allows for retaining the chosen "implied context" for each template element.
> 
> I see, it is just a stack.  Is there a reason you used a HashMap rather than a Vector to implement the stack?  A Vector seems both more efficient and to be a clearer representation of a stack.
> 
> > Source/WebCore/html/parser/HTMLTreeBuilder.h:237
> > +#if ENABLE(TEMPLATE_ELEMENT)
> > +    HashMap<Element*, InsertionMode> m_templateInsertionModes;
> > +#endif
> 
> Interesting!  Does this need to be a hashmap?  I would have expected just a Vector<InsertionMode> that we'd push and pop in parallel with the stack of open elements.  (We can overwrite the top of the stack in processStartTag.

Switched to a vector-as-stack.
Comment 6 Adam Barth 2012-12-06 17:25:53 PST
Comment on attachment 178095 [details]
Patch

Should we assert that the stack is empty when we're done parsing?
Comment 7 Adam Klein 2012-12-06 18:03:22 PST
(In reply to comment #6)
> (From update of attachment 178095 [details])
> Should we assert that the stack is empty when we're done parsing?

Well, right now, it's not always empty. For example, in the fragment-parsing mode, it's always size 1 when we finish. And I haven't added code to, e.g., processEndOfFile to clear out the stack. But I am a little worried about it getting out of sync with the stack of open elements. If I were going to add such an assert, would it go in finished()?
Comment 8 Rafael Weinstein 2012-12-06 19:18:31 PST
Thanks for taking over this one as well.

FWIW, I'm fine with what you guys decide here. The reason why I used a hashmap rather than a vector is that I was worried about maintaining a 'stack within a stack'. In other words, its seems to me that that the only logical stack here is the stack of open elements and that the map was encoding a property which gets applied to each <template> encountered during parsing, but that properties lifetime is tied to a single invocation of the parser.
Comment 9 Adam Klein 2012-12-07 10:56:56 PST
(In reply to comment #8)
> Thanks for taking over this one as well.
> 
> FWIW, I'm fine with what you guys decide here. The reason why I used a hashmap rather than a vector is that I was worried about maintaining a 'stack within a stack'. In other words, its seems to me that that the only logical stack here is the stack of open elements and that the map was encoding a property which gets applied to each <template> encountered during parsing, but that properties lifetime is tied to a single invocation of the parser.

For what it's worth, running the original (HashMap-based) patch in debug mode caused run-template.html to crash for me. I think there may be some issues with having to get ahold of the current template when wanting to find the current template insertion mode.

Perhaps we should integrate this enum stack directly into the element stack?
Comment 10 Adam Klein 2012-12-14 14:02:12 PST
Created attachment 179530 [details]
Patch with better ASSERTs
Comment 11 Eric Seidel (no email) 2012-12-18 12:03:21 PST
Comment on attachment 179530 [details]
Patch with better ASSERTs

Seems reasonable.
Comment 12 Eric Seidel (no email) 2012-12-18 12:04:09 PST
The review tool seems to have lost all my comments!?!
Comment 13 Eric Seidel (no email) 2012-12-18 12:05:04 PST
Comment on attachment 179530 [details]
Patch with better ASSERTs

View in context: https://bugs.webkit.org/attachment.cgi?id=179530&action=review

> Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2517
> +#if ENABLE(TEMPLATE_ELEMENT) && !ASSERT_DISABLED

Why is this disabled in release?

> LayoutTests/html5lib/resources/template.dat:847
> +<body><template><thead></thead><template><tr></tr></template><tr></tr><tfoot></tfoot></template>

Do we need additional tests (for misnested templates, etc)?
Comment 14 Adam Klein 2012-12-18 12:27:48 PST
Comment on attachment 179530 [details]
Patch with better ASSERTs

View in context: https://bugs.webkit.org/attachment.cgi?id=179530&action=review

>> Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2517
>> +#if ENABLE(TEMPLATE_ELEMENT) && !ASSERT_DISABLED
> 
> Why is this disabled in release?

I had this here since only an ASSERT depends on the fact that the vector is cleared before destruction. I was worried about performance, but I guess we'll take the hit anyway when we destroy the tree builder, so I may as well remove the disable-in-release thing.

>> LayoutTests/html5lib/resources/template.dat:847
>> +<body><template><thead></thead><template><tr></tr></template><tr></tr><tfoot></tfoot></template>
> 
> Do we need additional tests (for misnested templates, etc)?

There are already some mis-nested examples in this file. Did you have particular test cases you had in mind?
Comment 15 Adam Klein 2012-12-18 12:28:41 PST
Created attachment 180004 [details]
Patch for landing
Comment 16 WebKit Review Bot 2012-12-18 13:07:38 PST
Comment on attachment 180004 [details]
Patch for landing

Clearing flags on attachment: 180004

Committed r138059: <http://trac.webkit.org/changeset/138059>
Comment 17 WebKit Review Bot 2012-12-18 13:07:43 PST
All reviewed patches have been landed.  Closing bug.
Comment 18 Tony Chang 2012-12-18 13:47:19 PST
(In reply to comment #12)
> The review tool seems to have lost all my comments!?!

See https://bugs.webkit.org/show_bug.cgi?id=105252 .  I've seen it too, but we need repro steps.