[Webkit-unassigned] [Bug 43758] HTML TreeBuilder hits ASSERT in fragment case with insertAdjacentHTML and colgroup

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=43758





--- Comment #1 from Eric Seidel <eric at webkit.org>  2010-08-09 17:00:36 PST ---
OK, the bug is that HTMLElement::insertAdjacentHTML is passing the wrong contextElement.

It's passing the colgroup (this) instead of the div.  It's possible that insertAdjacentHTML("afterBegin", "HTML") would hit this ASSERT too, but we need to fix the context element bug first.

This bug has been around for forever, since the xml parser was always passed the wrong context.  The design is wrong, because we can't create the DocumentFragment before we know where we're inserting it.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.