Summary: | HTMLStackItem should include <template> as a special tag | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Takashi Sakamoto <tasak> | ||||||
Component: | DOM | Assignee: | Rafael Weinstein <rafaelw> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | abarth, adamk, eric, esprehn+autocc, inferno, ojan.autocc, rafaelw, webkit.review.bot | ||||||
Priority: | P1 | ||||||||
Version: | 528+ (Nightly build) | ||||||||
Hardware: | Unspecified | ||||||||
OS: | Unspecified | ||||||||
Attachments: |
|
Description
Takashi Sakamoto
2013-03-22 01:00:39 PDT
Created attachment 194463 [details]
repro.html
I guess, the crash reason would be that HTMLTreeBuilder::processAnyOtherEndTagForInBody checks items out of <template>. When token type is end and toke name is dummy (c.f. repro.html), processAnyOtherEndTagForInBody(dummy), mode(7) HTMLStackItem(span) HTMLStackItem(template) HTMLStackItem(dummy) <---- this dummy will be removed, but this is not a child of <template>. This is an oversight in the implementation of template element. Note the spec instructs that <template> should be considered a "special" tag: https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/templates/index.html#parsing Created attachment 194575 [details]
Patch
ping. Comment on attachment 194575 [details]
Patch
Thanks.
Comment on attachment 194575 [details] Patch Clearing flags on attachment: 194575 Committed r146904: <http://trac.webkit.org/changeset/146904> All reviewed patches have been landed. Closing bug. |