tree 808a3f8478d287992e6af1ff9a217bbaff5fa9da
parent 79f7a8eb63ac4f8bf4e92a18057191aefbf0c5c1
author rniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1385014231 +0000
committer rniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1385014231 +0000

[HTML parser] reset insertion mode appropriate must check for "in select in table" mode
https://bugs.webkit.org/show_bug.cgi?id=123850

Reviewed by Antti Koivisto.

Source/WebCore:

Merge https://chromium.googlesource.com/chromium/blink/+/2cb7523df57dfb48111f6aa16b7138cd54024ba7

The HTML specification has been updated to detect encountering a template element inside of a select element,
which in turn is inside of a table element. In this case, the select element will cause the parser to be in
"InSelectInTable" mode. Thus when the template element closes, it should return to that mode.

The fix here is that resetInsertionModeAppropriately must continue looking up the stack if the first node is
select element to see whether the select element is inside of a table element.

See also: http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#reset-the-insertion-mode-appropriately

Test: html5lib/resources/template.dat

* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately):

LayoutTests:

* html5lib/resources/template.dat:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159607 268f45cc-cd09-0410-ab3c-d52691b4dbfc