[Webkit-unassigned] [Bug 32393] Comments and PIs in the internal subset appear as siblings of the doctype

Thu Feb 7 04:18:44 PST 2019

https://bugs.webkit.org/show_bug.cgi?id=32393

--- Comment #4 from Simon Pieters <zcorpan at gmail.com> ---
New URL to reproduce:

http://software.hixie.ch/utilities/js/live-dom-viewer/saved/6580

says [object ProcessingInstruction] should say [object DocumentType].

<!DOCTYPE html>
...<iframe src="data:text/xml,<!DOCTYPE html [<?x?>]><html xmlns='http://www.w3.org/1999/xhtml'><script>alert(document.documentElement.previousSibling)</script></html>"> 

or:

http://software.hixie.ch/utilities/js/live-dom-viewer/saved/6581

The xml-stylesheet should not apply but is applied.

<!DOCTYPE html>
...<iframe src="data:text/xml,<!DOCTYPE html [<?xml-stylesheet href='data:text/css,*{background:red}'?>]><html xmlns='http://www.w3.org/1999/xhtml'>There should be no red.</html>">

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190207/39538912/attachment.html>