HTML parser: execute self-closing SVG script element

https://bugs.webkit.org/show_bug.cgi?id=268168 Reviewed by Ryosuke Niwa and Chris Dumez. The code is largely structured like the HTML Standard, except we currently do not fake an end tag as needed for m_scriptToProcess to be properly assigned to. As foreign content supports self-closing start tags we also have to pretend the start tag is a non-self-closing one. This results in some slight code smell, but it seems acceptable enough. Gecko does this correctly already. Aligns WPT with this commit: web-platform-tests/wpt@eef173b * LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/support/svg-script-self-closing.js: Added. * LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/support/w3c-import.log: * LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/unclosed-svg-script-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/unclosed-svg-script.html: * Source/WebCore/html/parser/AtomHTMLToken.h: (WebCore::AtomHTMLToken::setSelfClosingToFalse): * Source/WebCore/html/parser/HTMLTreeBuilder.cpp: (WebCore::HTMLTreeBuilder::processTokenInForeignContent): Canonical link: https://commits.webkit.org/273697@main
WebKit · Jan 29, 2024 · 5199ed9 · 5199ed9
1 parent c460ef0
commit 5199ed9
Show file tree

Hide file tree

Showing 6 changed files with 29 additions and 1 deletion.
diff --git a/...ts/imported/w3c/web-platform-tests/html/syntax/parsing/support/svg-script-self-closing.js b/...ts/imported/w3c/web-platform-tests/html/syntax/parsing/support/svg-script-self-closing.js
@@ -0,0 +1 @@
+scriptSelfClosing = true;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/support/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/support/w3c-import.log
@@ -18,3 +18,4 @@ List of files:
 /LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/support/no-doctype-name-eof.html
 /LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/support/no-doctype-name-line.html
 /LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/support/no-doctype-name-space.html
+/LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/support/svg-script-self-closing.js
diff --git a/...ests/imported/w3c/web-platform-tests/html/syntax/parsing/unclosed-svg-script-expected.txt b/...ests/imported/w3c/web-platform-tests/html/syntax/parsing/unclosed-svg-script-expected.txt
@@ -4,4 +4,5 @@ PASS SVG scripts with end tag should run
 PASS SVG scripts without end tag should not run
 PASS SVG scripts with bogus end tag inside should run
 PASS SVG scripts ended by HTML breakout should not run
+PASS SVG scripts with self-closing start tag should run
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/unclosed-svg-script.html b/LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/unclosed-svg-script.html
@@ -8,6 +8,7 @@
     var scriptWithoutEndTagRan = false;
     var scriptWithBogusEndTagInsideRan = false;
     var scriptWithBreakout = false;
+    var scriptSelfClosing = false;
 </script>
 <svg>
     <script>scriptWithEndTagRan = true;</script>
@@ -21,6 +22,9 @@
 <svg>
     <script>scriptWithBreakout = true;<s></script>
 </svg>
+<svg>
+    <script href="support/svg-script-self-closing.js"/>
+</svg>
 </s>
 <script>
     test(function() {
@@ -35,4 +39,7 @@
     test(function() {
         assert_false(scriptWithBreakout);
     }, "SVG scripts ended by HTML breakout should not run");
+    test(function() {
+        assert_true(scriptSelfClosing);
+    }, "SVG scripts with self-closing start tag should run");
 </script>
diff --git a/Source/WebCore/html/parser/AtomHTMLToken.h b/Source/WebCore/html/parser/AtomHTMLToken.h
@@ -66,6 +66,7 @@ class AtomHTMLToken {
 
     TagName tagName() const;
     bool selfClosing() const;
+    void setSelfClosingToFalse();
     const Vector<Attribute>& attributes() const;
 
     // Characters
@@ -138,6 +139,14 @@ inline bool AtomHTMLToken::selfClosing() const
     return m_selfClosing;
 }
 
+inline void AtomHTMLToken::setSelfClosingToFalse()
+{
+    ASSERT(m_selfClosing);
+    ASSERT(m_type == Type::StartTag);
+    ASSERT(m_tagName == TagName::script);
+    m_selfClosing = false;
+}
+
 inline Vector<Attribute>& AtomHTMLToken::attributes()
 {
     ASSERT(m_type == Type::StartTag || m_type == Type::EndTag);

diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -3030,14 +3030,23 @@ void HTMLTreeBuilder::processTokenInForeignContent(AtomHTMLToken&& token)
         default:
             break;
         }
-        const AtomString& currentNamespace = adjustedCurrentNode.namespaceURI();
+        auto& currentNamespace = adjustedCurrentNode.namespaceURI();
         if (currentNamespace == MathMLNames::mathmlNamespaceURI)
             adjustMathMLAttributes(token);
         if (currentNamespace == SVGNames::svgNamespaceURI) {
             adjustSVGTagNameCase(token);
             adjustSVGAttributes(token);
         }
         adjustForeignAttributes(token);
+
+        if (token.tagName() == TagName::script && token.selfClosing() && currentNamespace == SVGNames::svgNamespaceURI) {
+            token.setSelfClosingToFalse();
+            m_tree.insertForeignElement(WTFMove(token), currentNamespace);
+            AtomHTMLToken fakeToken(HTMLToken::Type::EndTag, TagName::script);
+            processTokenInForeignContent(WTFMove(fakeToken));
+            return;
+        }
+
         m_tree.insertForeignElement(WTFMove(token), currentNamespace);
         break;
     }