After reading all the responses and consulting with several developers at Google and other WebKit contributors, I have reached the conclusion that we should fix this bug, and the script parsed by createContextualFragment should, indeed, run when the fragment is inserted into a document.<div>
<br></div><div>I'll follow up when the bug is fixed and WebKit's behavior is matched that of Firefox.</div><div><br><div><div><div><div><span class="Apple-style-span" style="border-collapse: collapse; font-family: arial, sans-serif; font-size: 13px; "><div>
Best regards,</div><div>Ryosuke Niwa<br><font color="#999999">Software Engineer</font><div><font color="#999999">Google Inc.</font></div></div></span></div><div><div><br><div class="gmail_quote">On Thu, Nov 11, 2010 at 4:34 PM, Ryosuke Niwa <span dir="ltr"><<a href="mailto:rniwa@webkit.org">rniwa@webkit.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Greetings all,<div><br></div><div>I'm working on the <a href="https://bugs.webkit.org/show_bug.cgi?id=12234" target="_blank">WebKit bug 12234 - Using createContextualFragment to insert a <script> does not cause the script to execute</a>. While investigating the issue, the following part of HTML5 spec came to my attention:</div>
<div><br></div><div><b><a href="http://www.whatwg.org/specs/web-apps/current-work/#parsing-main-inhead" target="_blank">10.2.5.7 The "in head" insertion mode</a></b></div><div>...</div><div><ul><li><b>A start tag whose tag name is "script"</b><br>
</li><ol><li>If the parser was originally created for the HTML fragment parsing algorithm, then mark the script element as "already started". (fragment case)</li></ol></ul></div><div>Since <a href="http://www.whatwg.org/specs/web-apps/current-work/#fragment-case" target="_blank">10.4 Parsing HTML fragments</a> does not special case the script element, this seem to imply that we never execute scripts inserted by the HTML fragment parsing algorithm. Am I right?</div>
<div><br></div><div>To give you more concrete example, should the following markup show the alert or not?</div><div><span style="font-family:Verdana, sans-serif;border-collapse:collapse"><pre style="font-size:medium;font-family:monospace;white-space:pre-wrap;width:auto">
<!DOCTYPE html>
<html>
<script>
document.body.innerHTML+="<scr"+"ipt>alert('SUCCESS')</scr"+"ipt>";
</script>
</html></pre></span></div><div><br></div><div>Best regards,</div><div>Ryosuke Niwa<br><font color="#999999">Software Engineer</font><div><font color="#999999">Google Inc.</font></div><div><font color="#999999"><br>
</font></div><br>
</div>
</blockquote></div><br></div></div></div></div></div></div>