[Bug 10338] New: End tag of </td> or </th> in "in cell" mode wrongly asserts current node will be "tr"

http://www.w3.org/Bugs/Public/show_bug.cgi?id=10338

           Summary: End tag of </td> or </th> in "in cell" mode wrongly
                    asserts current node will be "tr"
           Product: HTML WG
           Version: unspecified
          Platform: PC
        OS/Version: All
            Status: NEW
          Severity: critical
          Priority: P1
         Component: HTML5 spec (editor: Ian Hickson)
        AssignedTo: ian@hixie.ch
        ReportedBy: eric@webkit.org
         QAContact: public-html-bugzilla@w3.org
                CC: mike@w3.org, public-html@w3.org, w3c@adambarth.com


End tag of </td> or </th> in "in cell" mode wrongly asserts current node will
be "tr"

http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#parsing-main-intd

The passage:

Switch the insertion mode to "in row". (The current node will be a tr element
at this point.)

The current node will not necessarily be a tr in the fragment case.

WebKit had this as an ASSERT in our TreeBuilder:
http://trac.webkit.org/browser/trunk/WebCore/html/HTMLTreeBuilder.cpp?rev=65006#L2000

But that ASSERT is false in the case of:

<table><tr></tr></table>
<script>
    rows = document.getElementsByTagName("tr");
    for (i = 0; i < rows.length; ++i)
        rows[i].innerHTML += "<td>foo</td>";
</script>

Assuming I"m understanding the fragment case and how innerHTML is supposed to
work correctly.

I recommend changing "(The current node will be a tr element at this point.)"
to "(The current node will be a tr element at this point, except in the
fragment case.)"

In the fragment case the "context element" must be a tr for this to be allowed
(I think).

-- 
Configure bugmail: http://www.w3.org/Bugs/Public/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.

Received on Monday, 9 August 2010 23:25:11 UTC