|Summary:||REGRESSION (iOS 8): When constructing a new document that has sibling forms, the second form ends up being a child of the first form|
|Product:||WebKit||Reporter:||Shawn Jansepar <shawnjan>|
|Severity:||Major||CC:||benjamin, justin, kpeatt, m.goleb+bugzilla, mikek, stewart, tedtate, timmywillisn, webkit-bug-importer|
|Version:||528+ (Nightly build)|
|Hardware:||iPhone / iPad|
Description Shawn Jansepar 2014-10-02 01:29:04 PDT
Summary: When constructing a new document using document.implementation.createHTMLDocument and setting innerHTML of the body of that new document with a string of HTML content that has sibling forms, the second form ends up being a child of the first form. This is something I've only ever encountered on iOS8 Safari (has been tested all the way down to iOS4.2, Android 2.1, Firefox 4, etc without any issue). Steps to Reproduce: 1. Grab minimal test case and run it on iOS8.0.(0|1|2) 2. Note that the document isn't correctly constructed, as the second form ends up becoming a child of the first form. Expected Results: The document created from the string should have forms as siblings of one and other. Actual Results: The document isn't correctly constructed, as the second form ends up becoming a child of the first form. Version: iOS8 (12A365) and newer A minimal test case is attached.
Comment 1 Shawn Jansepar 2014-10-02 01:29:38 PDT
Created attachment 239090 [details] Minimal test case
Comment 3 Michał Gołębiowski-Owczarek 2014-12-10 02:09:12 PST
This broke a security-related patch in jQuery: https://github.com/jquery/jquery/pull/1505 We had to back it out because it broke Safari 8.