This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.
When the tree builder sees an EOF, it should mark all HTML and SVG script elements on the stack (SVG makes it possible to have more than one) as malformed in the DOM. Then the serialization algorithm should check the malformedness flag and omit the end tag of the <script> element if the element has been marked malformed. This way, the malformedness round-trips, so serializing and reparsing doesn't make a malformed script run. http://software.hixie.ch/utilities/js/live-dom-viewer/saved/123 shows that Firefox and Opera do this.
How should it handle such elements when they're not at the "end" of the document?
The same as when they are at the end at the document. If you append a text node "//" and another script element after the "malformed" script element, the malformed script would run after round-tripping.
For reference, the Gecko implementation of what zcorpan says is http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsHTMLContentSerializer.cpp#336
CVS blame points to https://bugzilla.mozilla.org/show_bug.cgi?id=305873 The hack works for serializing the whole document through Save As... Complete. The hack may fail if the page modified its own DOM via another script that wasn't malformed.
This seems very dubious to me. Wouldn't a better solution be to do something like set a bogus type="" on that <script>, like text/plain, or remove any text nodes in that script, or comment out the script, or something?
This bug predates the HTML Working Group Decision Policy. If you are satisfied with the resolution of this bug, please change the state of this bug to CLOSED. If you have additional information and would like the editor to reconsider, please reopen this bug. If you would like to escalate the issue to the full HTML Working Group, please add the TrackerRequest keyword to this bug, and suggest title and text for the tracker issue; or you may create a tracker issue yourself, if you are able to do so. For more details, see this document: http://dev.w3.org/html5/decision-policy/decision-policy.html This bug is now being moved to VERIFIED. Please respond within two weeks. If this bug is not closed, reopened or escalated within two weeks, it may be marked as NoReply and will no longer be considered a pending comment.