Bug 21292 - HTML5 parser does inspect the namespace of elements on the stack of open elements
HTML5 parser does inspect the namespace of elements on the stack of open elem...
Status: RESOLVED FIXED
Product: HTML WG
Classification: Unclassified
Component: HTML5 spec
unspecified
PC All
: P2 normal
: ---
Assigned To: This bug has no owner yet - up for the taking
HTML WG Bugzilla archive list
: CR
Depends on:
Blocks: 21293
  Show dependency treegraph
 
Reported: 2013-03-14 23:12 UTC by Rafael Weinstein
Modified: 2013-07-08 15:18 UTC (History)
10 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Rafael Weinstein 2013-03-14 23:12:06 UTC
Given the ability to embed foreign content, this seems like a generic problem. Here's one instance:

<body><table><tr><td><svg><td><foreignObject></td>Foo<foo>

When <svg> is encountered, the insertion mode is left as "in cell", as it is when the </td> is encountered.

This issue here is the </td>. The rules for "in cell" for </td> say

"Pop elements from the stack of open elements stack until an element with the same tag name as the token has been popped from the stack."

Maybe "tag name" implies localName and namespaceURI, but that's not how it's implemented anywhere.

In Webkit and Gecko, the element it pops back to is <svg td>, and the continues parsing from there. This produces:

| <html>
|   <head>
|   <body>
|     <table>
|       <tbody>
|         <tr>
|           <td>
|             <svg svg>
|               <svg td>
|                 <svg foreignObject>
|               "Foo"
|               <svg foo>

I'm actually not sure what the "right" output is here, but the above doesn't seem like a candidate. I can imagine:

| <html>
|   <head>
|   <body>
|     "Foo"
|     <foo>
|     <table>
|       <tbody>
|         <tr>
|           <td>
|             <svg svg>
|               <svg td>
|                 <svg foreignObject>

Where the </td> clears back past the first (html) <td>, and the "Foo", and <foo> get lifted out of the table.

I can also imagine:

| <html>
|   <head>
|   <body>
|     <table>
|       <tbody>
|         <tr>
|           <td>
|             <svg svg>
|               <svg td>
|                 <svg foreignObject>
|                   "Foo"
|                   <foo>

Where the </td> is ignored (perhaps because we define "in scope" to not search past the <svg foreignObject>
Comment 1 Adam Klein 2013-03-15 15:39:10 UTC
See also http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2013-February/039025.html regarding similar issues when parsing <math>
Comment 3 Robin Berjon 2013-07-08 15:18:36 UTC
EDITOR'S RESPONSE: This is an Editor's Response to your comment. If you are
satisfied with this response, please change the state of this bug to CLOSED. If
you have additional information and would like the Editor to reconsider, please
reopen this bug. If you would like to escalate the issue to the full HTML
Working Group, please add the TrackerRequest keyword to this bug, and suggest
title and text for the Tracker Issue; or you may create a Tracker Issue
yourself, if you are able to do so. For more details, see this document:

   http://dev.w3.org/html5/decision-policy/decision-policy.html

Status: Accepted
Change Description: applied WHATWG fix
https://www.w3.org/Bugs/Public/show_bug.cgi?id=21308