[Webkit-unassigned] [Bug 43758] HTML TreeBuilder hits ASSERT in fragment case with insertAdjacentHTML and colgroup

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Aug 10 01:05:36 PDT 2010


Eric Seidel <eric at webkit.org> changed:

           What    |Removed                     |Added
                 CC|                            |ian at hixie.ch

--- Comment #3 from Eric Seidel <eric at webkit.org>  2010-08-10 01:05:36 PST ---
It appears the spec wants to drop character tokens on the floor:


Anything else
Act as if an end tag with the tag name "colgroup" had been seen, and then, if that token wasn't ignored, reprocess the current token.

The fake end tag token here can only be ignored in the fragment case.

We don't have any way to "ignore" character tokens currently.  We could make one.  But this may also be a spec bug.

The reduced test case to ASSERT is:

document.createElement("colgroup").innerHTML = "foo";

Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

More information about the webkit-unassigned mailing list