LayoutTests:

LayoutTests:

        Reviewed by John.

        Test for Repro crash due to infinite recursion in HTMLParser::handleError @ youos.com
        <rdar://problem/5237811>

        * fast/table/incomplete-table-in-fragment-hang-expected.txt: Added.
        * fast/table/incomplete-table-in-fragment-hang.html: Added.

WebCore:

        Reviewed by John.

        Fix Repro crash due to infinite recursion in HTMLParser::handleError @ youos.com
        <rdar://problem/5237811>

        It is possible to add table parts (thead etc) without table ancestor to a document fragment. If a new table element
        was added to such a part, as in

        div.innerHTML = '<tbody><table>';

        the parser error handling code would try to pop the previous table as normal. However since
        the table does not actually exist nothing would happen and parser would go to infinite recursion.

        Solution here is to pop table parts one by one when handling the error inside a fragment instead of trying to pop
        the table straight away (as it might not exist).

        * html/HTMLParser.cpp:
        (WebCore::HTMLParser::handleError):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@23991 268f45cc-cd09-0410-ab3c-d52691b4dbfc