LayoutTests:
authorantti <antti@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 4 Jul 2007 22:54:49 +0000 (22:54 +0000)
committerantti <antti@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 4 Jul 2007 22:54:49 +0000 (22:54 +0000)
commit34543b1b23dbc44a5c20e49d85f61c149a4c8d07
tree859b230977b6cfd24b0de7878dd9d18fbdae9244
parent04df8d060d29c1e99abacb220e7e89a1bb0ae1a1
LayoutTests:

        Reviewed by John.

        Test for Repro crash due to infinite recursion in HTMLParser::handleError @ youos.com
        <rdar://problem/5237811>

        * fast/table/incomplete-table-in-fragment-hang-expected.txt: Added.
        * fast/table/incomplete-table-in-fragment-hang.html: Added.

WebCore:

        Reviewed by John.

        Fix Repro crash due to infinite recursion in HTMLParser::handleError @ youos.com
        <rdar://problem/5237811>

        It is possible to add table parts (thead etc) without table ancestor to a document fragment. If a new table element
        was added to such a part, as in

        div.innerHTML = '<tbody><table>';

        the parser error handling code would try to pop the previous table as normal. However since
        the table does not actually exist nothing would happen and parser would go to infinite recursion.

        Solution here is to pop table parts one by one when handling the error inside a fragment instead of trying to pop
        the table straight away (as it might not exist).

        * html/HTMLParser.cpp:
        (WebCore::HTMLParser::handleError):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@23991 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/table/incomplete-table-in-fragment-hang-expected.txt [new file with mode: 0644]
LayoutTests/fast/table/incomplete-table-in-fragment-hang.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/html/HTMLParser.cpp