[html5] r3538 - [cgt] (2) Fix an infinite loop in parser: <select><input>, <select><keygen>, and [...]

[whatwg at whatwg.org]

Author: ianh
Date: 2009-08-04 16:55:24 -0700 (Tue, 04 Aug 2009)
New Revision: 3538

Modified:
   index
   source
Log:
[cgt] (2) Fix an infinite loop in parser: <select><input>, <select><keygen>, and <select><textarea> when setting innerHTML on a <select>. Thanks to gsnedders for catching this.

Modified: index
===================================================================
--- index	2009-08-04 23:34:49 UTC (rev 3537)
+++ index	2009-08-04 23:55:24 UTC (rev 3538)
@@ -64702,8 +64702,16 @@
 
    <dt>A start tag whose tag name is one of: "input", "keygen", "textarea"</dt>
    <dd>
-    <p><a href=#parse-error>Parse error</a>. Act as if an end tag with the tag
-    name "select" had been seen, and reprocess the token.</p>
+
+    <p><a href=#parse-error>Parse error</a>.</p>
+
+    <p>If the <a href=#stack-of-open-elements>stack of open elements</a> does not <a href=#has-an-element-in-table-scope title="has an element in table scope">have an element in table
+    scope</a> with the same tag name as the token, ignore the
+    token. (<a href=#fragment-case>fragment case</a>)</p>
+
+    <p>Otherwise, act as if an end tag with the tag name "select" had
+    been seen, and reprocess the token.</p>
+
    </dd>
 
    <dt>A start tag token whose tag name is "script"</dt>

Modified: source
===================================================================
--- source	2009-08-04 23:34:49 UTC (rev 3537)
+++ source	2009-08-04 23:55:24 UTC (rev 3538)
@@ -79299,8 +79299,17 @@
 
    <dt>A start tag whose tag name is one of: "input", "keygen", "textarea"</dt>
    <dd>
-    <p><span>Parse error</span>. Act as if an end tag with the tag
-    name "select" had been seen, and reprocess the token.</p>
+
+    <p><span>Parse error</span>.</p>
+
+    <p>If the <span>stack of open elements</span> does not <span
+    title="has an element in table scope">have an element in table
+    scope</span> with the same tag name as the token, ignore the
+    token. (<span>fragment case</span>)</p>
+
+    <p>Otherwise, act as if an end tag with the tag name "select" had
+    been seen, and reprocess the token.</p>
+
    </dd>
 
    <dt>A start tag token whose tag name is "script"</dt>