Bug 123850 – [HTML parser] reset insertion mode appropriate must check for "in select in table" mode

• Component: DOM
• Status: RESOLVED FIXED

[Ryosuke Niwa]

Merge https://chromium.googlesource.com/chromium/blink/+/2cb7523df57dfb48111f6aa16b7138cd54024ba7

The HTML spec has been updated to detect encountering a <template> inside of a <select> which is inside of a <table>. In this case the <select> will cause the parser to be in "InSelectInTable" mode. Thus when the <template> closes, it should return to that mode.

The fix here is that resetInsertionModeAppropriately must continue looking up the stack if the first node is <select> to see whether the <select> is inside of a <table>

[Ryosuke Niwa]

Created attachment 217396 [details]
Fixes the bug

[Ryosuke Niwa]

Comment on attachment 217396 [details]
Fixes the bug

View in context: https://bugs.webkit.org/attachment.cgi?id=217396&action=review

> Source/WebCore/html/parser/HTMLTreeBuilder.cpp:1645
> +                while (item->node() != m_tree.openElements()->rootNode() && !item->hasTagName(templateTag)) {

Oops, I need to wrap this entire block with ENABLE(TEMPLTE_ELEMENT).
Will do that before landing it.

[Ryosuke Niwa]

Comment on attachment 217396 [details]
Fixes the bug

Oops, I forgot to check my own comment :(

[Ryosuke Niwa]

Committed r159607: <http://trac.webkit.org/changeset/159607>