| commit | 303749d9278e31e8d28e9e4639ebb6aca3576815 | [log] [tgz] |
|---|---|---|
| author | rniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> | Thu Nov 21 06:10:31 2013 +0000 |
| committer | rniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> | Thu Nov 21 06:10:31 2013 +0000 |
| tree | 808a3f8478d287992e6af1ff9a217bbaff5fa9da | |
| parent | 79f7a8eb63ac4f8bf4e92a18057191aefbf0c5c1 [diff] |
[HTML parser] reset insertion mode appropriate must check for "in select in table" mode https://bugs.webkit.org/show_bug.cgi?id=123850 Reviewed by Antti Koivisto. Source/WebCore: Merge https://chromium.googlesource.com/chromium/blink/+/2cb7523df57dfb48111f6aa16b7138cd54024ba7 The HTML specification has been updated to detect encountering a template element inside of a select element, which in turn is inside of a table element. In this case, the select element will cause the parser to be in "InSelectInTable" mode. Thus when the template element closes, it should return to that mode. The fix here is that resetInsertionModeAppropriately must continue looking up the stack if the first node is select element to see whether the select element is inside of a table element. See also: http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#reset-the-insertion-mode-appropriately Test: html5lib/resources/template.dat * html/parser/HTMLTreeBuilder.cpp: (WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately): LayoutTests: * html5lib/resources/template.dat: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159607 268f45cc-cd09-0410-ab3c-d52691b4dbfc