[Webkit-unassigned] [Bug 44390] New: HTML5 TreeBuilder builds wrong DOM for <a><svg><tr><input></a>

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=44390

           Summary: HTML5 TreeBuilder builds wrong DOM for
                    <a><svg><tr><input></a>
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Major
          Priority: P1
         Component: WebCore Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: eric at webkit.org
                CC: eric at webkit.org, sam at webkit.org, ddkilzer at webkit.org,
                    abarth at webkit.org, inferno at chromium.org,
                    tonyg at chromium.org
        Depends on: 44170


HTML5 TreeBuilder builds wrong DOM for <a><svg><tr><input></a>

The problem is that when we wrote "in foreign content" mode, the spec was broken.  I believe Ian has since fixed it, but we need to update our loop to pop each non-html element off the stack before we end up processing the </a> tag.

Should be an easy fix assuming the spec is sane now. :)

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.