This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.
(cloning bug to WHATWG component so I can investigate whether the suggested clarification is worth it) +++ This bug was initially created as a clone of Bug #18367 +++ Consider the stack of open elements to be : html, body, form, table, tbody (form being present is irrelevant to this imo). The current insertion mode is IN TABLE BODY as expected. When the next token being consumed is end tag p, then the parser will go into an infinite loop. IN TABLE BODY will delegate to IN TABLE, which will delegate to IN BODY with foster parenting enabled. The end tag p will cause a 'act as if' start token for p (since there is no P in button scope) - which will go through same flow to end in IN BODY with foster parenting enabled. The resulting insertion of p tag due to then token will get foster parent'ed - and so, on return, reconsumption of end tag p will essentially cause the same loop to be repeated indefinitely. Looks like even when foster parent'ed, the node to be inserted must be pushed to open elements stack - might be good to clarify this since we figured it out via trial and error.
Checked in as WHATWG revision r7441. Check-in comment: Try to clarify the foster parenting logic... http://html5.org/tools/web-apps-tracker?from=7440&to=7441