<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[195117] releases/WebKitGTK/webkit-2.10</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/195117">195117</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2016-01-15 03:32:29 -0800 (Fri, 15 Jan 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/193840">r193840</a> - form.elements should reflect the element ordering after the HTML tree builder algorithm
https://bugs.webkit.org/show_bug.cgi?id=148870
rdar://problem/22589879
Patch by Keith Rollin <krollin@apple.com> on 2015-12-09
Reviewed by Ryosuke Niwa.
LayoutTests/imported/w3c:
Rebaseline existing test.
* web-platform-tests/html/semantics/forms/the-form-element/form-elements-nameditem-02-expected.txt:
Source/WebCore:
form.elements should return form-associated elements in tree order.
However, when presented with an HTML fragment like the following,
forms.elements is not built in tree order. Instead, the elements
appear in forms.element in the same order they appear in the HTML --
that is in the same order as they are parsed.
<form id=form>
<table>
<tr>
<td><input type="radio" name="radio1" id="<a href="http://trac.webkit.org/projects/webkit/changeset/1">r1</a>" value=1></td>
<td><input type="radio" name="radio2" id="<a href="http://trac.webkit.org/projects/webkit/changeset/2">r2</a>" value=2></td>
<input type="radio" name="radio0" id="<a href="http://trac.webkit.org/projects/webkit/changeset/0">r0</a>" value=0>
</tr>
</table>
</form>
The reason why elements appear in forms.elements in parse order is
because they register themselves with the designated form when they
are created. At this time, they are not in the DOM tree, so the form
can only assume that the element will be appended to the DOM tree,
with the result that it records the elements in the HTML fragment
above as [<a href="http://trac.webkit.org/projects/webkit/changeset/1">r1</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/2">r2</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/0">r0</a>].
However, it's not always the case that the newly-created element will
be appended to the current tree. In the HTML fragment above, the <a href="http://trac.webkit.org/projects/webkit/changeset/0">r0</a>
input element is hoised out of the table element. It ends up being the
preceding sibling of the table element, with the result that the
actual tree-order of the input elements is [<a href="http://trac.webkit.org/projects/webkit/changeset/0">r0</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/1">r1</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/2">r2</a>].
Because the problem is due to registering form-associated elements
with the form *before* the elements are added to the DOM tree, the
solution is to defer that registration until afterwards. With the new
element in the tree, the form can now use its current location in the
tree to correctly place the element in form.elements.
Existing tests now pass:
- imported/w3c/web-platform-tests/html/semantics/forms/the-form-element/form-elements-nameditem-02-html
* html/FormAssociatedElement.cpp:
(WebCore::FormAssociatedElement::FormAssociatedElement):
(WebCore::FormAssociatedElement::insertedInto):
(WebCore::FormAssociatedElement::removedFrom):
(WebCore::FormAssociatedElement::formRemovedFromTree):
(WebCore::FormAssociatedElement::formWillBeDestroyed):
* html/FormAssociatedElement.h:
* html/HTMLFormControlElement.cpp:
(WebCore::HTMLFormControlElement::HTMLFormControlElement):
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::HTMLImageElement):
(WebCore::HTMLImageElement::insertedInto):
(WebCore::HTMLImageElement::removedFrom):
* html/HTMLImageElement.h:
* html/HTMLObjectElement.cpp:
(WebCore::HTMLObjectElement::HTMLObjectElement):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit210LayoutTestsimportedw3cChangeLog">releases/WebKitGTK/webkit-2.10/LayoutTests/imported/w3c/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit210SourceWebCoreChangeLog">releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit210SourceWebCorehtmlFormAssociatedElementcpp">releases/WebKitGTK/webkit-2.10/Source/WebCore/html/FormAssociatedElement.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit210SourceWebCorehtmlFormAssociatedElementh">releases/WebKitGTK/webkit-2.10/Source/WebCore/html/FormAssociatedElement.h</a></li>
<li><a href="#releasesWebKitGTKwebkit210SourceWebCorehtmlHTMLFormControlElementcpp">releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLFormControlElement.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit210SourceWebCorehtmlHTMLImageElementcpp">releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLImageElement.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit210SourceWebCorehtmlHTMLImageElementh">releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLImageElement.h</a></li>
<li><a href="#releasesWebKitGTKwebkit210SourceWebCorehtmlHTMLObjectElementcpp">releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLObjectElement.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit210LayoutTestsimportedw3cChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/LayoutTests/imported/w3c/ChangeLog (195116 => 195117)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/LayoutTests/imported/w3c/ChangeLog 2016-01-15 11:21:34 UTC (rev 195116)
+++ releases/WebKitGTK/webkit-2.10/LayoutTests/imported/w3c/ChangeLog 2016-01-15 11:32:29 UTC (rev 195117)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2015-12-09 Keith Rollin <krollin@apple.com>
+
+ form.elements should reflect the element ordering after the HTML tree builder algorithm
+ https://bugs.webkit.org/show_bug.cgi?id=148870
+ rdar://problem/22589879
+
+ Reviewed by Ryosuke Niwa.
+
+ Rebaseline existing test.
+
+ * web-platform-tests/html/semantics/forms/the-form-element/form-elements-nameditem-02-expected.txt:
+
</ins><span class="cx"> 2015-09-22 Ryosuke Niwa <rniwa@webkit.org>
</span><span class="cx">
</span><span class="cx"> Event fired on a detached node does not bubble up
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210SourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog (195116 => 195117)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-15 11:21:34 UTC (rev 195116)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/ChangeLog 2016-01-15 11:32:29 UTC (rev 195117)
</span><span class="lines">@@ -1,3 +1,66 @@
</span><ins>+2015-12-09 Keith Rollin <krollin@apple.com>
+
+ form.elements should reflect the element ordering after the HTML tree builder algorithm
+ https://bugs.webkit.org/show_bug.cgi?id=148870
+ rdar://problem/22589879
+
+ Reviewed by Ryosuke Niwa.
+
+ form.elements should return form-associated elements in tree order.
+ However, when presented with an HTML fragment like the following,
+ forms.elements is not built in tree order. Instead, the elements
+ appear in forms.element in the same order they appear in the HTML --
+ that is in the same order as they are parsed.
+
+ <form id=form>
+ <table>
+ <tr>
+ <td><input type="radio" name="radio1" id="r1" value=1></td>
+ <td><input type="radio" name="radio2" id="r2" value=2></td>
+ <input type="radio" name="radio0" id="r0" value=0>
+ </tr>
+ </table>
+ </form>
+
+ The reason why elements appear in forms.elements in parse order is
+ because they register themselves with the designated form when they
+ are created. At this time, they are not in the DOM tree, so the form
+ can only assume that the element will be appended to the DOM tree,
+ with the result that it records the elements in the HTML fragment
+ above as [r1, r2, r0].
+
+ However, it's not always the case that the newly-created element will
+ be appended to the current tree. In the HTML fragment above, the r0
+ input element is hoised out of the table element. It ends up being the
+ preceding sibling of the table element, with the result that the
+ actual tree-order of the input elements is [r0, r1, r2].
+
+ Because the problem is due to registering form-associated elements
+ with the form *before* the elements are added to the DOM tree, the
+ solution is to defer that registration until afterwards. With the new
+ element in the tree, the form can now use its current location in the
+ tree to correctly place the element in form.elements.
+
+ Existing tests now pass:
+ - imported/w3c/web-platform-tests/html/semantics/forms/the-form-element/form-elements-nameditem-02-html
+
+ * html/FormAssociatedElement.cpp:
+ (WebCore::FormAssociatedElement::FormAssociatedElement):
+ (WebCore::FormAssociatedElement::insertedInto):
+ (WebCore::FormAssociatedElement::removedFrom):
+ (WebCore::FormAssociatedElement::formRemovedFromTree):
+ (WebCore::FormAssociatedElement::formWillBeDestroyed):
+ * html/FormAssociatedElement.h:
+ * html/HTMLFormControlElement.cpp:
+ (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+ * html/HTMLImageElement.cpp:
+ (WebCore::HTMLImageElement::HTMLImageElement):
+ (WebCore::HTMLImageElement::insertedInto):
+ (WebCore::HTMLImageElement::removedFrom):
+ * html/HTMLImageElement.h:
+ * html/HTMLObjectElement.cpp:
+ (WebCore::HTMLObjectElement::HTMLObjectElement):
+
</ins><span class="cx"> 2015-12-09 Frederic Wang <fred.wang@free.fr>
</span><span class="cx">
</span><span class="cx"> Bad position of large operators inside an munderover element
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210SourceWebCorehtmlFormAssociatedElementcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/html/FormAssociatedElement.cpp (195116 => 195117)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Source/WebCore/html/FormAssociatedElement.cpp 2016-01-15 11:21:34 UTC (rev 195116)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/html/FormAssociatedElement.cpp 2016-01-15 11:32:29 UTC (rev 195117)
</span><span class="lines">@@ -49,8 +49,9 @@
</span><span class="cx"> FormAssociatedElement& m_element;
</span><span class="cx"> };
</span><span class="cx">
</span><del>-FormAssociatedElement::FormAssociatedElement()
</del><ins>+FormAssociatedElement::FormAssociatedElement(HTMLFormElement* form)
</ins><span class="cx"> : m_form(nullptr)
</span><ins>+ , m_formSetByParser(form)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -68,10 +69,15 @@
</span><span class="cx">
</span><span class="cx"> void FormAssociatedElement::insertedInto(ContainerNode& insertionPoint)
</span><span class="cx"> {
</span><ins>+ HTMLElement& element = asHTMLElement();
+ if (m_formSetByParser) {
+ setForm(m_formSetByParser);
+ m_formSetByParser = nullptr;
+ }
+
</ins><span class="cx"> if (!insertionPoint.inDocument())
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- HTMLElement& element = asHTMLElement();
</del><span class="cx"> if (element.fastHasAttribute(formAttr))
</span><span class="cx"> resetFormAttributeTargetObserver();
</span><span class="cx"> }
</span><span class="lines">@@ -84,7 +90,7 @@
</span><span class="cx"> // If the form and element are both in the same tree, preserve the connection to the form.
</span><span class="cx"> // Otherwise, null out our form and remove ourselves from the form's list of elements.
</span><span class="cx"> if (m_form && element.highestAncestor() != m_form->highestAncestor())
</span><del>- setForm(0);
</del><ins>+ setForm(nullptr);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> HTMLFormElement* FormAssociatedElement::findAssociatedForm(const HTMLElement* element, HTMLFormElement* currentAssociatedForm)
</span><span class="lines">@@ -112,7 +118,7 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_form);
</span><span class="cx"> if (asHTMLElement().highestAncestor() != formRoot)
</span><del>- setForm(0);
</del><ins>+ setForm(nullptr);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void FormAssociatedElement::setForm(HTMLFormElement* newForm)
</span><span class="lines">@@ -142,7 +148,7 @@
</span><span class="cx"> if (!m_form)
</span><span class="cx"> return;
</span><span class="cx"> willChangeForm();
</span><del>- m_form = 0;
</del><ins>+ m_form = nullptr;
</ins><span class="cx"> didChangeForm();
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210SourceWebCorehtmlFormAssociatedElementh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/html/FormAssociatedElement.h (195116 => 195117)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Source/WebCore/html/FormAssociatedElement.h 2016-01-15 11:21:34 UTC (rev 195116)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/html/FormAssociatedElement.h 2016-01-15 11:32:29 UTC (rev 195117)
</span><span class="lines">@@ -88,7 +88,7 @@
</span><span class="cx"> void formAttributeTargetChanged();
</span><span class="cx">
</span><span class="cx"> protected:
</span><del>- FormAssociatedElement();
</del><ins>+ FormAssociatedElement(HTMLFormElement*);
</ins><span class="cx">
</span><span class="cx"> void insertedInto(ContainerNode&);
</span><span class="cx"> void removedFrom(ContainerNode&);
</span><span class="lines">@@ -116,6 +116,7 @@
</span><span class="cx">
</span><span class="cx"> std::unique_ptr<FormAttributeTargetObserver> m_formAttributeTargetObserver;
</span><span class="cx"> HTMLFormElement* m_form;
</span><ins>+ HTMLFormElement* m_formSetByParser;
</ins><span class="cx"> String m_customValidationMessage;
</span><span class="cx"> };
</span><span class="cx">
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210SourceWebCorehtmlHTMLFormControlElementcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLFormControlElement.cpp (195116 => 195117)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLFormControlElement.cpp 2016-01-15 11:21:34 UTC (rev 195116)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLFormControlElement.cpp 2016-01-15 11:32:29 UTC (rev 195117)
</span><span class="lines">@@ -48,6 +48,7 @@
</span><span class="cx">
</span><span class="cx"> HTMLFormControlElement::HTMLFormControlElement(const QualifiedName& tagName, Document& document, HTMLFormElement* form)
</span><span class="cx"> : LabelableElement(tagName, document)
</span><ins>+ , FormAssociatedElement(form)
</ins><span class="cx"> , m_disabled(false)
</span><span class="cx"> , m_isReadOnly(false)
</span><span class="cx"> , m_isRequired(false)
</span><span class="lines">@@ -60,7 +61,6 @@
</span><span class="cx"> , m_wasChangedSinceLastFormControlChangeEvent(false)
</span><span class="cx"> , m_hasAutofocused(false)
</span><span class="cx"> {
</span><del>- setForm(form);
</del><span class="cx"> setHasCustomStyleResolveCallbacks();
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210SourceWebCorehtmlHTMLImageElementcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLImageElement.cpp (195116 => 195117)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLImageElement.cpp 2016-01-15 11:21:34 UTC (rev 195116)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLImageElement.cpp 2016-01-15 11:32:29 UTC (rev 195117)
</span><span class="lines">@@ -51,7 +51,8 @@
</span><span class="cx"> HTMLImageElement::HTMLImageElement(const QualifiedName& tagName, Document& document, HTMLFormElement* form)
</span><span class="cx"> : HTMLElement(tagName, document)
</span><span class="cx"> , m_imageLoader(*this)
</span><del>- , m_form(form)
</del><ins>+ , m_form(nullptr)
+ , m_formSetByParser(form)
</ins><span class="cx"> , m_compositeOperator(CompositeSourceOver)
</span><span class="cx"> , m_imageDevicePixelRatio(1.0f)
</span><span class="cx"> #if ENABLE(SERVICE_CONTROLS)
</span><span class="lines">@@ -60,8 +61,6 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasTagName(imgTag));
</span><span class="cx"> setHasCustomStyleResolveCallbacks();
</span><del>- if (form)
- form->registerImgElement(this);
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> Ref<HTMLImageElement> HTMLImageElement::create(Document& document)
</span><span class="lines">@@ -243,12 +242,17 @@
</span><span class="cx">
</span><span class="cx"> Node::InsertionNotificationRequest HTMLImageElement::insertedInto(ContainerNode& insertionPoint)
</span><span class="cx"> {
</span><del>- if (!m_form) { // m_form can be non-null if it was set in constructor.
- m_form = HTMLFormElement::findClosestFormAncestor(*this);
- if (m_form)
- m_form->registerImgElement(this);
</del><ins>+ if (m_formSetByParser) {
+ m_form = m_formSetByParser;
+ m_formSetByParser = nullptr;
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+ if (!m_form)
+ m_form = HTMLFormElement::findClosestFormAncestor(*this);
+
+ if (m_form)
+ m_form->registerImgElement(this);
+
</ins><span class="cx"> // Insert needs to complete first, before we start updating the loader. Loader dispatches events which could result
</span><span class="cx"> // in callbacks back to this node.
</span><span class="cx"> Node::InsertionNotificationRequest insertNotificationRequest = HTMLElement::insertedInto(insertionPoint);
</span><span class="lines">@@ -272,7 +276,7 @@
</span><span class="cx"> if (insertionPoint.inDocument() && !m_lowercasedUsemap.isNull())
</span><span class="cx"> document().removeImageElementByLowercasedUsemap(*m_lowercasedUsemap.impl(), *this);
</span><span class="cx">
</span><del>- m_form = 0;
</del><ins>+ m_form = nullptr;
</ins><span class="cx"> HTMLElement::removedFrom(insertionPoint);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -463,7 +467,7 @@
</span><span class="cx"> return false;
</span><span class="cx">
</span><span class="cx"> const AtomicString& usemap = fastGetAttribute(usemapAttr);
</span><del>-
</del><ins>+
</ins><span class="cx"> // If the usemap attribute starts with '#', it refers to a map element in the document.
</span><span class="cx"> if (usemap.string()[0] == '#')
</span><span class="cx"> return false;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210SourceWebCorehtmlHTMLImageElementh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLImageElement.h (195116 => 195117)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLImageElement.h 2016-01-15 11:21:34 UTC (rev 195116)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLImageElement.h 2016-01-15 11:32:29 UTC (rev 195117)
</span><span class="lines">@@ -124,6 +124,7 @@
</span><span class="cx">
</span><span class="cx"> HTMLImageLoader m_imageLoader;
</span><span class="cx"> HTMLFormElement* m_form;
</span><ins>+ HTMLFormElement* m_formSetByParser;
</ins><span class="cx"> CompositeOperator m_compositeOperator;
</span><span class="cx"> AtomicString m_bestFitImageURL;
</span><span class="cx"> #if ENABLE(PICTURE_SIZES)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit210SourceWebCorehtmlHTMLObjectElementcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLObjectElement.cpp (195116 => 195117)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLObjectElement.cpp 2016-01-15 11:21:34 UTC (rev 195116)
+++ releases/WebKitGTK/webkit-2.10/Source/WebCore/html/HTMLObjectElement.cpp 2016-01-15 11:32:29 UTC (rev 195117)
</span><span class="lines">@@ -65,11 +65,11 @@
</span><span class="cx">
</span><span class="cx"> inline HTMLObjectElement::HTMLObjectElement(const QualifiedName& tagName, Document& document, HTMLFormElement* form, bool createdByParser)
</span><span class="cx"> : HTMLPlugInImageElement(tagName, document, createdByParser, ShouldNotPreferPlugInsForImages)
</span><ins>+ , FormAssociatedElement(form)
</ins><span class="cx"> , m_docNamedItem(true)
</span><span class="cx"> , m_useFallbackContent(false)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasTagName(objectTag));
</span><del>- setForm(form);
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> inline HTMLObjectElement::~HTMLObjectElement()
</span></span></pre>
</div>
</div>
</body>
</html>