186537 - Javascript write() output invalidate comment structure

Status: RESOLVED DUPLICATE of bug 165323

(Core :: DOM: HTML Parser, defect)

Description

[Ruslan Ismailov]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3a) Gecko/20021212
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3a) Gecko/20021212

This code is derive from one of internet-counters, and was validate from W3C. 
This simple code should made aumatic 'comment' structure. 

<script type="text/javascript"><!--
document.write('<'+'!-- ')
//--></script>
<script type="text/javascript"><!--
if(2>1)document.write('--'+'>')
//--></script>

So it's output should be nill. But by an unknown reason, output of firm write()
made a second script commented and (wich is more important) sign of > become the
end of this comment.

So if I change 2>1 to 1<2 in if() statement, result would be different. 

Reproducible: Always

Steps to Reproduce:
1.Run http://www.stabes.nm.ru/bug.htm
2.
3.

Actual Results:  
In first block there is wrotten: 1)document.write('--'+'>') //-->

Expected Results:  
This text is a part of <script> code and shpould not be showned

Opera and IE both write() result is O'k. Same as Mozilla result could be
obtained by Galeon on Linux. This bug could be easily workaround by web-designer
(not use > symbols in scripts), but this is not wery good.

Comment 1

[Frank Wein [:mcsmurf]]

Perhaps dupe of Bug 165323

Comment 2

[Ruslan Ismailov]

No, I think it is not same to 165323 -- there is no problem with writing
"comment" field (as you see, this code use '<'+'!--' to workaround same problem
in old browsers. 

Comment 3

[Johnny Stenback (:jst)]

Confirming, and over to the HTML parser component.

Comment 4

[Ruslan Ismailov]

O'k. I study http://www.w3.org/TR/html4/intro/sgmltut.html#h-3.2.4 a lot and now
know what is happened. Le me show it first. Let us wrote a following html-code:

<!--
<script type="text/javascript"><!-- 
if(2>1)document.write('--'+'>')
//--></script>

It's correct code but with a some mistake in comment structure. We see that <!--
open the comment, and when we search where is finish. We know, that  between --
and > could be be white space, but as we could note, also if between -- and > is
some letters, it counted as finish too. So I think this is problem N1, --xxx>
also counted as comment finish.

Secondary problem in code. 

<!--
<script type="text/javascript"><!-- 
if(2<1)document.write('--'+'>')
//--></script>

We see, that it is finished wihout any text, so '>' symbol is not finishing.
Why? because secondary '--' invalidate first '--' even between them is some letters.

So I see that real trouble is in HTML comments parsing. Could somebody tell me,
is there bug about --xxx> closing comment? If yes, this bug should be duplicate.

Comment 5

[Ruslan Ismailov]

*** This bug has been marked as a duplicate of 186768 ***

Comment 6

[Ruslan Ismailov]

Hm. Look that this behaviour of comment structure is desired, so we realy have
problem, described by me first.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Frank is right.  The 2>1 case has an unterminated comment, triggering bug 165323

*** This bug has been marked as a duplicate of 165323 ***