|document.implementation.createHTMLDocument(title)| wrongly parses the value of the title parameter as a part of HTML source, violating both old DOM2 HTML CR [1] and HTML5 [2]. [1] http://www.w3.org/TR/2002/CR-DOM-Level-2-HTML-20020605/html.html#HTML-DOM-createHTMLDocument [2] http://www.whatwg.org/specs/web-apps/current-work/multipage/dom.html#dom-domhtmlimplementation-createhtmldocument Steps to reproduce: Execute the following JavaScript code: javascript:alert(document.implementation.createHTMLDocument('foo</title>').title); Expected result: foo</title> Actual result: foo Confirmed on WebKit-r50095.
Created attachment 42269 [details] proposed fix
Committed <http://trac.webkit.org/changeset/50389>.