Bug 268217 – HTML entity parsing hits SegmentedString::pushBack() assert through document.write()

• Component: DOM
• Status: RESOLVED FIXED

[Anne van Kesteren]

Testcase to reproduce:

<script>
function f() {
  for (x of "&abc") {
    document.write(x);
  }
}
onload = f
</script>

data:text/html,<script>%0Afunction%20f()%20{%0A%20%20for%20(x%20of%20"&abc")%20{%0A%20%20%20%20document.write(x);%0A%20%20}%0A}%0Aonload%20=%20f%0A</script>

This relates to these failures in TestExpectations:

[ Debug ] imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_entities01.html?run_type=write_single [ Skip ]
[ Debug ] imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_html5test-com.html?run_type=write_single [ Skip ]
[ Debug ] imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_plain-text-unsafe.html?run_type=write_single [ Skip ]
[ Debug ] imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_tests2.html?run_type=write_single [ Skip ]
[ Debug ] imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_tests24.html?run_type=write_single [ Skip ]

Based on bug 39935 my suspicion is that this has to do with the use of prepend.

[Radar WebKit Bug Importer]

<rdar://problem/122229666>

[Vitaly Dyackhov]

Pull request: https://github.com/WebKit/WebKit/pull/33391

[EWS]

Committed 283540@main (818118e729fb): <https://commits.webkit.org/283540@main>

Reviewed commits have been landed. Closing PR #33391 and removing active labels.