[Webkit-unassigned] [Bug 43758] HTML TreeBuilder hits ASSERT in fragment case with insertAdjacentHTML and colgroup

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Mon Aug 9 17:00:36 PDT 2010


--- Comment #1 from Eric Seidel <eric at webkit.org>  2010-08-09 17:00:36 PST ---
OK, the bug is that HTMLElement::insertAdjacentHTML is passing the wrong contextElement.

It's passing the colgroup (this) instead of the div.  It's possible that insertAdjacentHTML("afterBegin", "HTML") would hit this ASSERT too, but we need to fix the context element bug first.

This bug has been around for forever, since the xml parser was always passed the wrong context.  The design is wrong, because we can't create the DocumentFragment before we know where we're inserting it.

Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

More information about the webkit-unassigned mailing list