[Bug 10118] in foreign content "current node is not an element in the HTML namespace" algorithm is wrong

http://www.w3.org/Bugs/Public/show_bug.cgi?id=10118


Eric Seidel <eric@webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |eric@webkit.org
           Priority|P3                          |P1
           Severity|normal                      |critical




--- Comment #1 from Eric Seidel <eric@webkit.org>  2010-07-09 05:20:04 ---
Testcase: "<svg></table>"

Algorithm per the spec:

An end tag, if the current node is not an element in the HTML namespace.

Run these steps:

1. Initialize node to be the current node (the bottommost node of the stack).

2. If node is not an element with the same tag name as the token, then this is
a parse error.

3. Loop: If node has the same tag name as the token, pop elements from the
stack of open elements until node has been popped from the stack, and then
abort these steps.

4. Set node to the previous entry in the stack of open elements.

5. If node is an element in the HTML namespace, process the token using the
rules for the secondary insertion mode. If, after doing so, the insertion mode
is still "in foreign content", but there is no element in scope that has a
namespace other than the HTML namespace, switch the insertion mode to the
secondary insertion mode.

6. Return to the step labeled loop.

It seems that step 2. should have an "abort these steps" after it.   Otherwise
the steps will just walk off the bottom end of the stack looking for a <table>
element.

-- 
Configure bugmail: http://www.w3.org/Bugs/Public/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.

Received on Friday, 9 July 2010 05:22:04 UTC