[Webkit-unassigned] [Bug 43758] HTML TreeBuilder hits ASSERT in fragment case with insertAdjacentHTML and colgroup

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=43758


Eric Seidel <eric at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ian at hixie.ch




--- Comment #3 from Eric Seidel <eric at webkit.org>  2010-08-10 01:05:36 PST ---
It appears the spec wants to drop character tokens on the floor:

http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#parsing-main-incolgroup

Anything else
Act as if an end tag with the tag name "colgroup" had been seen, and then, if that token wasn't ignored, reprocess the current token.

The fake end tag token here can only be ignored in the fragment case.


We don't have any way to "ignore" character tokens currently.  We could make one.  But this may also be a spec bug.

The reduced test case to ASSERT is:

document.createElement("colgroup").innerHTML = "foo";

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.