308140 - Style tag inside form tag closes form too early when added with innerHTML

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Martijn Wargers (dead)]

When adding:
<form><style></style><div>This should be inside the black bordered box</div></form>
with the innerHTML method, the <form> tag is closed now directly and only
encloses the <style> tag.
This regressed between 2005-09-09 and 2005-09-10, which makes bug 272702 the
most likely cause.
I'll attach a testcase.

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase

Look at the second black bordered box, the "This should be inside the black
bordered box" should be inside the black bordered box. That is what IE6 is
doing.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix.

My own comment has come back to bite me! We were not pushing anything onto the
content stack in the fragment sink when we tried to open the head for the
style, then we went ahead and closed the currently-opened container when we
closed the head at the end of the <style>, causing us to close the <form> too
early.

We may want to consider moving over to flags at some point, since we are up to
5 packed bools in the fragment sink.

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 196756 [details] [diff] [review]
Fix.

+  PRPackedBool mIgnoreNextClose;

Maybe mIgnoreNextCloseHead as this is only used for OpenHead/CloseHead calls?

r+sr=jst

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked in.

Sorry for taking so long to get to this, Martijn, and thanks for the really
reduced testcase.

Comment 5

[Martijn Wargers (dead)]

Thanks for fixing! Verified.

Comment 6

[Kevin Johnston]

There remain some similar serious problems along these lines in FF 1.5rc2.

I work on the new Yahoo Mail Beta (Oddpost descendant), and we are seeing frequent problems with display of email bodies within our application.  They are updated into the preview pane, or compose areas, using innerHTML.  Bodies that contain STYLE tags are showing a lot of problems.

We started seeing these with RC1 (we had no reports of this in beta 2 that I know of, but probably many fewer users using beta 2).  Reports from one user ar that RC2 works much better for her mail than RC1.  I still have several message bodies that fail to display in RC2, however.  We have reduced an example to a simple self-contained set of test cases.  One of them is really interesting in that it severely damages the DOM.  Attachment coming shortly.

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Kevin, please file a new bug on those problems. This regression was caused by a bug whose fix was not checked into the Firefox 1.5 branch. Any problems you are seeing are the results of other bugs.

Comment 8

[Kevin Johnston]

Attachment: Several examples of innerHTML breaking badly when the source text contains a STYLE tag

This document demonstrates, using very short examples, some severe problems rendering into the innerHTML of an element, when the source text contains a STYLE tag.

The last example is particularly interesting, as it badly damages the document.  Elements all over the page will disappear when you press it.

We are looking into a workaround, e.g. whether we can achieve what we want with document.write instead.

Comment 9

[Kevin Johnston]

Thanks for the tip.  Sorry I didn't notice that.

Comment 10

[Martijn Wargers (dead)]

The issues mentioned in comment 6 and further have been filed as bug 315999.