[Webkit-unassigned] [Bug 91703] New: Use the original token to create an element in "reconstruct the active formatting elements" and "call the adoption agency"

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=91703

           Summary: Use the original token to create an element in
                    "reconstruct the active formatting elements" and "call
                    the adoption agency"
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: skyul at company100.net


The current WebKit HTML5 parser implementation does not hold the original token in the stack of open elements and the active formatting elements. This is problematic because the original token is used create an element in "reconstruct the active formatting elements" and "call the adoption agency". As a workaround, WebKit uses the saved element instead of the original token to create an element. But this is wrong as described in the following FIXME comment:

PassRefPtr<Element> HTMLConstructionSite::createHTMLElementFromSavedElement(Element* element)
{
    // FIXME: This method is wrong.  We should be using the original token.
    // Using an Element* causes us to fail examples like this:
    // <b id="1"><p><script>document.getElementById("1").id = "2"</script></p>TEXT</b>
    // When reconstructTheActiveFormattingElements calls this method to open
    // a second <b> tag to wrap TEXT, it will have id "2", even though the HTML5
    // spec implies it should be "1".  Minefield matches the HTML5 spec here.
    ...
}

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.