[Webkit-unassigned] [Bug 90428] Fall thorugh in handling a "button" start tag in HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken&)

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=90428





--- Comment #3 from Kwang Yul Seo <skyul at company100.net>  2012-07-02 22:06:09 PST ---
(In reply to comment #2)
> How do we know this is safe?  Can you explain in more detail?  The reason we have this FIXME here is because we're not sure its safe.

Okay, I will explain it in more detail. Because I am new to parser code, maybe I misunderstood something. Please tell me if I am wrong.

    if (token.name() == buttonTag) {
        if (m_tree.openElements()->inScope(buttonTag)) {
            parseError(token);
            processFakeEndTag(buttonTag);

// We are still in the "in body" mode because processing a "button" end tag in the "in body" mode does not change the insertion mode.

// Now we need to process the token again in the "in body" mode

// I assumed that there is only one button element in the stack of open elements. The button element was popped in processFakeEndTag(buttonTag), so we don't need to check if we are in the button scope.

// So instead of calling processStartTag(token) which in turn calls processStartTagForInBody(token), we can fall through here.

            processStartTag(token); // FIXME: Could we just fall through here?
            return;
        }
        m_tree.reconstructTheActiveFormattingElements();
        m_tree.insertHTMLElement(token);
        m_framesetOk = false;
        return;
    }

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.