[Webkit-unassigned] [Bug 92903] New: SVG fragment string is parsed incorrectly by insertHTML

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=92903

           Summary: SVG fragment string is parsed incorrectly by
                    insertHTML
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: rlobkovsky at hotmail.com


I have a (valid) string describing an inline SVG (pasted at the end). When used in a standalone SVG file, it is rendered correctly. However, when using insertHTML to append it to a DIV, the resulting DOM is wrong. The first linearGradient contains all the rest of the elements, instead of being their sibling under the SVG header element. In other words, the closing tag of the first linearGradient is being ignored.

SVG string:
<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 263 112" onclick="MG.forms.FormPanel.generateTileEvent('', '0','gd3','6')" id="ext-gen1104"><linearGradient id="tileBGgrad" x1="0%" y1="0%" x2="100%" y2="0%"><stop stop-color="rgb(255,255,255)" offset="0%"></stop><stop stop-color="rgb(0,0,255)" offset="100%"></stop></linearGradient><rect x="0" id="bg" y="0" width="263" height="112" style="fill:url(#tileBGgrad)"></rect><g id="ext-gen1105"><rect x="6" y="78" width="72" height="21" fill="Transparent"></rect><clipPath id="ck0clipCB"><rect x="7" y="79" width="14" height="14"></rect></clipPath><image x="7" y="31" width="14" height="84" overflow="hidden" preserveAspectRatio="xMaxYMin slice" clip-path="url(#ck0clipCB)" xlink:href="Content/images/checkbox_sprite.gif" onclick="var event = arguments[0] || window.event; MG.forms.FormPanel.generateTileEvent('ck0', '0','gd3','6'); event.stopPropagation();"></image><clipPath id="ck0clip"><r
<tspan x="134" dy="1em"> 3:30:02 PM</tspan></text></g><g id="ext-gen1108"><linearGradient id="lb3grad" x1="0%" y1="0%" x2="0%" y2="100%"><stop stop-color="rgb(255,0,0)" offset="0%" stop-opacity="0.50"></stop><stop stop-color="rgb(255,255,255)" offset="100%"></stop></linearGradient><rect x="10" y="11" width="65" height="25" fill="none" style="fill:url(#lb3grad)"></rect><clipPath id="lb3clip"><rect x="11" y="12" width="63" height="23"></rect></clipPath><text dominant-baseline="hanging" y="13" x="74" clip-path="url(#lb3clip)" text-anchor="end" fill="#555555">Test 1:</text></g><g id="ext-gen1110"><rect x="6" y="46" width="72" height="25" fill="Transparent"></rect><clipPath id="lb4clip"><rect x="7" y="47" width="70" height="23"></rect></clipPath><text id="ext-gen1109" style="font-family: Arial, Helvetica, 'URW Gothic L', sans-serif; font-size: 10pt; font-weight: normal; font-style: normal; " dominant-baseline="hanging" y="48" x="77" clip-path="url(#lb4clip)" text-anchor="end" fill="#55555

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.